diff options
| author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2020-09-17 16:34:12 +0200 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2020-09-18 12:28:11 +0000 |
| commit | fa7a83953047fa79c27dc8e5bb9d42cb07fe2b7f (patch) | |
| tree | 44bd3631b485361d66c87d58ce46d72ee79349e3 | |
| parent | 0d7248345dfde075122b135370e77f76334bba38 (diff) | |
xpm handler: fix read error caused by off-by-one in overflow check
The recently introduced overflow check for 8 bit images was too
aggressive, causing the last pixel on each line to be rejected.
As a driveby, add the same (fixed) overflow check also for 32bit
images.
Fixes: QTBUG-86691
Change-Id: I62e4d5884e314f1171cb5a3e2c48657ce7259676
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
(cherry picked from commit 6f2c7469f86785e6ba81fe0280210ef7275099de)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
| -rw-r--r-- | src/gui/image/qxpmhandler.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/gui/image/qxpmhandler.cpp b/src/gui/image/qxpmhandler.cpp index 417dab7ce3..14823b457e 100644 --- a/src/gui/image/qxpmhandler.cpp +++ b/src/gui/image/qxpmhandler.cpp @@ -973,7 +973,7 @@ static bool read_xpm_body( } else { char b[16]; b[cpp] = '\0'; - for (x=0; x<w && d+cpp<end; x++) { + for (x = 0; x < w && d + cpp <= end; x++) { memcpy(b, (char *)d, cpp); *p++ = (uchar)colorMap[xpmHash(b)]; d += cpp; @@ -991,7 +991,7 @@ static bool read_xpm_body( int x; char b[16]; b[cpp] = '\0'; - for (x=0; x<w && d<end; x++) { + for (x = 0; x < w && d + cpp <= end; x++) { memcpy(b, (char *)d, cpp); *p++ = (QRgb)colorMap[xpmHash(b)]; d += cpp; |