Make bytes-per-line safe for int overflow

Goes through the Qt code and make sure bytes-per-line calculations are
safe when they are too big for 32bit integers.

Change-Id: I88b2d74b3da82e91407d316aa932a4a37587c0cf
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

31 files changed, 93 insertions, 73 deletions

diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
index 32b6131309..d447faaceb 100644
--- a/src/gui/image/qbmphandler.cpp
+++ b/src/gui/image/qbmphandler.cpp
@@ -777,9 +777,9 @@ bool QBmpHandler::write(const QImage &img)
     }
 
     int nbits;
-    int bpl_bmp;
+    qsizetype bpl_bmp;
     // Calculate a minimum bytes-per-line instead of using whatever value this QImage is using internally.
-    int bpl = ((image.width() * image.depth() + 31) >> 5) << 2;
+    qsizetype bpl = ((image.width() * image.depth() + 31) >> 5) << 2;
 
     if (image.depth() == 8 && image.colorCount() <= 16) {
         bpl_bmp = (((bpl+1)/2+3)/4)*4;
@@ -791,6 +791,8 @@ bool QBmpHandler::write(const QImage &img)
         bpl_bmp = bpl;
         nbits = image.depth();
     }
+    if (qsizetype(int(bpl_bmp)) != bpl_bmp)
+        return false;
 
     if (m_format == DibFormat) {
         QDataStream dibStream(device());
@@ -813,6 +815,8 @@ bool QBmpHandler::write(const QImage &img)
     bf.bfReserved2 = 0;
     bf.bfOffBits = BMP_FILEHDR_SIZE + BMP_WIN + image.colorCount() * 4;
     bf.bfSize = bf.bfOffBits + bpl_bmp*image.height();
+    if (qsizetype(bf.bfSize) != bf.bfOffBits + bpl_bmp*image.height())
+        return false;
     s << bf;
 
     // write image
diff --git a/src/gui/image/qimage.cpp b/src/gui/image/qimage.cpp
index 1319d9dffc..684051786d 100644
--- a/src/gui/image/qimage.cpp
+++ b/src/gui/image/qimage.cpp
@@ -781,7 +781,7 @@ QImage::QImage(const QSize &size, Format format)
 
 
 
-QImageData *QImageData::create(uchar *data, int width, int height,  int bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction, void *cleanupInfo)
+QImageData *QImageData::create(uchar *data, int width, int height,  qsizetype bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction, void *cleanupInfo)
 {
     if (width <= 0 || height <= 0 || !data || format == QImage::Format_Invalid)
         return nullptr;
@@ -793,7 +793,7 @@ QImageData *QImageData::create(uchar *data, int width, int height,  int bpl, QIm
 
     if (bpl > 0) {
         // can't overflow, because has calculateImageParameters already done this multiplication
-        const int min_bytes_per_line = (width * depth + 7)/8;
+        const qsizetype min_bytes_per_line = (qsizetype(width) * depth + 7)/8;
         if (bpl < min_bytes_per_line)
             return nullptr;
 
@@ -894,13 +894,17 @@ QImage::QImage(const uchar* data, int width, int height, Format format, QImageCl
     initially empty and must be sufficiently expanded with
     setColorCount() or setColorTable() before the image is used.
 */
+
+#if QT_VERSION >= QT_VERSION_CHECK(6,0,0)
+QImage::QImage(uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo)
+#else
 QImage::QImage(uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo)
+#endif
     :QPaintDevice()
 {
     d = QImageData::create(data, width, height, bytesPerLine, format, false, cleanupFunction, cleanupInfo);
 }
 
-
 /*!
     Constructs an image with the given \a width, \a height and \a
     format, that uses an existing memory buffer, \a data. The \a width
@@ -926,7 +930,11 @@ QImage::QImage(uchar *data, int width, int height, int bytesPerLine, Format form
     data being changed.
 */
 
+#if QT_VERSION >= QT_VERSION_CHECK(6,0,0)
+QImage::QImage(const uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo)
+#else
 QImage::QImage(const uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo)
+#endif
     :QPaintDevice()
 {
     d = QImageData::create(const_cast<uchar*>(data), width, height, bytesPerLine, format, true, cleanupFunction, cleanupInfo);
@@ -1165,7 +1173,7 @@ QImage QImage::copy(const QRect& r) const
         // Qt for Embedded Linux can create images with non-default bpl
         // make sure we don't crash.
         if (image.d->nbytes != d->nbytes) {
-            int bpl = qMin(bytesPerLine(), image.bytesPerLine());
+            qsizetype bpl = qMin(bytesPerLine(), image.bytesPerLine());
             for (int i = 0; i < height(); i++)
                 memcpy(image.scanLine(i), scanLine(i), bpl);
         } else
@@ -1224,7 +1232,7 @@ QImage QImage::copy(const QRect& r) const
     if (byteAligned) {
         const uchar *src = d->data + ((x * d->depth) >> 3) + y * d->bytes_per_line;
         uchar *dest = image.d->data + ((dx * d->depth) >> 3) + dy * image.d->bytes_per_line;
-        const int bytes_to_copy = (pixels_to_copy * d->depth) >> 3;
+        const qsizetype bytes_to_copy = (qsizetype(pixels_to_copy) * d->depth) >> 3;
         for (int i = 0; i < lines_to_copy; ++i) {
             memcpy(dest, src, bytes_to_copy);
             src += d->bytes_per_line;
@@ -1890,11 +1898,11 @@ void QImage::invertPixels(InvertMode mode)
 
     if (depth() < 32) {
         // This assumes no alpha-channel as the only formats with non-premultipled alpha are 32bit.
-        int bpl = (d->width * d->depth + 7) / 8;
+        qsizetype bpl = (qsizetype(d->width) * d->depth + 7) / 8;
         int pad = d->bytes_per_line - bpl;
         uchar *sl = d->data;
         for (int y=0; y<d->height; ++y) {
-            for (int x=0; x<bpl; ++x)
+            for (qsizetype x=0; x<bpl; ++x)
                 *sl++ ^= 0xff;
             sl += pad;
         }
@@ -4169,8 +4177,8 @@ int QImage::metric(PaintDeviceMetric metric) const
                         trigy += m12;
         // END OF MACRO
 bool qt_xForm_helper(const QTransform &trueMat, int xoffset, int type, int depth,
-                     uchar *dptr, int dbpl, int p_inc, int dHeight,
-                     const uchar *sptr, int sbpl, int sWidth, int sHeight)
+                     uchar *dptr, qsizetype dbpl, int p_inc, int dHeight,
+                     const uchar *sptr, qsizetype sbpl, int sWidth, int sHeight)
 {
     int m11 = int(trueMat.m11()*4096.0);
     int m12 = int(trueMat.m12()*4096.0);
@@ -4712,7 +4720,7 @@ QImage QImage::transformed(const QTransform &matrix, Qt::TransformationMode mode
 
     int bpp = depth();
 
-    int sbpl = bytesPerLine();
+    qsizetype sbpl = bytesPerLine();
     const uchar *sptr = bits();
 
     QImage::Format target_format = d->format;
@@ -4767,7 +4775,7 @@ QImage QImage::transformed(const QTransform &matrix, Qt::TransformationMode mode
 
         // create target image (some of the code is from QImage::copy())
         int type = format() == Format_Mono ? QT_XFORM_TYPE_MSBFIRST : QT_XFORM_TYPE_LSBFIRST;
-        int dbpl = dImage.bytesPerLine();
+        qsizetype dbpl = dImage.bytesPerLine();
         qt_xForm_helper(mat, 0, type, bpp, dImage.bits(), dbpl, 0, hd, sptr, sbpl, ws, hs);
     }
     copyMetadata(dImage.d, d);
diff --git a/src/gui/image/qimage.h b/src/gui/image/qimage.h
index 35dc41be2d..a9c0fbbe3e 100644
--- a/src/gui/image/qimage.h
+++ b/src/gui/image/qimage.h
@@ -117,8 +117,13 @@ public:
     QImage(int width, int height, Format format);
     QImage(uchar *data, int width, int height, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
     QImage(const uchar *data, int width, int height, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
+#if QT_VERSION >= QT_VERSION_CHECK(6,0,0)
+    QImage(uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
+    QImage(const uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
+#else
     QImage(uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
     QImage(const uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
+#endif
 
 #ifndef QT_NO_IMAGEFORMAT_XPM
     explicit QImage(const char * const xpm[]);
diff --git a/src/gui/image/qimage_p.h b/src/gui/image/qimage_p.h
index 9277472c3c..6f6f626858 100644
--- a/src/gui/image/qimage_p.h
+++ b/src/gui/image/qimage_p.h
@@ -67,7 +67,7 @@ struct Q_GUI_EXPORT QImageData {        // internal image data
     QImageData();
     ~QImageData();
     static QImageData *create(const QSize &size, QImage::Format format);
-    static QImageData *create(uchar *data, int w, int h,  int bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
+    static QImageData *create(uchar *data, int w, int h,  qsizetype bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr);
 
     QAtomicInt ref;
 
diff --git a/src/gui/image/qpixmap_win.cpp b/src/gui/image/qpixmap_win.cpp
index 8aad77b991..be6cd0c5fc 100644
--- a/src/gui/image/qpixmap_win.cpp
+++ b/src/gui/image/qpixmap_win.cpp
@@ -121,7 +121,7 @@ static inline void copyImageDataCreateAlpha(const uchar *data, QImage *target)
     const uint mask = target->format() == QImage::Format_RGB32 ? 0xff000000 : 0;
     const int height = target->height();
     const int width = target->width();
-    const int bytesPerLine = width * int(sizeof(QRgb));
+    const qsizetype bytesPerLine = width * sizeof(QRgb);
     for (int y = 0; y < height; ++y) {
         QRgb *dest = reinterpret_cast<QRgb *>(target->scanLine(y));
         const QRgb *src = reinterpret_cast<const QRgb *>(data + y * bytesPerLine);
diff --git a/src/gui/image/qplatformpixmap.cpp b/src/gui/image/qplatformpixmap.cpp
index 493f55514e..ea4243ba07 100644
--- a/src/gui/image/qplatformpixmap.cpp
+++ b/src/gui/image/qplatformpixmap.cpp
@@ -183,7 +183,7 @@ QBitmap QPlatformPixmap::mask() const
     mask.setColor(0, QColor(Qt::color0).rgba());
     mask.setColor(1, QColor(Qt::color1).rgba());
 
-    const int bpl = mask.bytesPerLine();
+    const qsizetype bpl = mask.bytesPerLine();
 
     for (int y = 0; y < h; ++y) {
         const QRgb *src = reinterpret_cast<const QRgb*>(image.scanLine(y));
@@ -216,7 +216,7 @@ void QPlatformPixmap::setMask(const QBitmap &mask)
             for (int y = 0; y < h; ++y) {
                 const uchar *mscan = imageMask.scanLine(y);
                 uchar *tscan = image.scanLine(y);
-                int bytesPerLine = image.bytesPerLine();
+                qsizetype bytesPerLine = image.bytesPerLine();
                 for (int i = 0; i < bytesPerLine; ++i)
                     tscan[i] &= mscan[i];
             }
diff --git a/src/gui/image/qplatformpixmap.h b/src/gui/image/qplatformpixmap.h
index 7635ac2949..9c7f5e5edf 100644
--- a/src/gui/image/qplatformpixmap.h
+++ b/src/gui/image/qplatformpixmap.h
@@ -163,7 +163,7 @@ private:
 
 #  define QT_XFORM_TYPE_MSBFIRST 0
 #  define QT_XFORM_TYPE_LSBFIRST 1
-Q_GUI_EXPORT bool qt_xForm_helper(const QTransform&, int, int, int, uchar*, int, int, int, const uchar*, int, int, int);
+Q_GUI_EXPORT bool qt_xForm_helper(const QTransform&, int, int, int, uchar*, qsizetype, int, int, const uchar*, qsizetype, int, int);
 
 QT_END_NAMESPACE
 
diff --git a/src/gui/image/qpnghandler.cpp b/src/gui/image/qpnghandler.cpp
index 8435e5a0fe..e6a3604ad4 100644
--- a/src/gui/image/qpnghandler.cpp
+++ b/src/gui/image/qpnghandler.cpp
@@ -455,7 +455,7 @@ static void read_image_scaled(QImage *outImage, png_structp png_ptr, png_infop i
     png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type, nullptr, nullptr, nullptr);
     png_get_oFFs(png_ptr, info_ptr, &offset_x, &offset_y, &unit_type);
     uchar *data = outImage->bits();
-    int bpl = outImage->bytesPerLine();
+    qsizetype bpl = outImage->bytesPerLine();
 
     if (scaledSize.isEmpty() || !width || !height)
         return;
@@ -709,7 +709,7 @@ bool QPngHandlerPrivate::readPngImage(QImage *outImage)
         png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type, nullptr, nullptr, nullptr);
         png_get_oFFs(png_ptr, info_ptr, &offset_x, &offset_y, &unit_type);
         uchar *data = outImage->bits();
-        int bpl = outImage->bytesPerLine();
+        qsizetype bpl = outImage->bytesPerLine();
         amp.row_pointers = new png_bytep[height];
 
         for (uint y = 0; y < height; y++)
diff --git a/src/gui/image/qppmhandler.cpp b/src/gui/image/qppmhandler.cpp
index 13ee2eadd2..195e58d283 100644
--- a/src/gui/image/qppmhandler.cpp
+++ b/src/gui/image/qppmhandler.cpp
@@ -135,7 +135,7 @@ static inline QRgb scale_pbm_color(quint16 mx, quint16 rv, quint16 gv, quint16 b
 static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, QImage *outImage)
 {
     int nbits, y;
-    int pbm_bpl;
+    qsizetype pbm_bpl;
     bool raw;
 
     QImage::Format format;
@@ -166,7 +166,7 @@ static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, Q
             return false;
     }
 
-    pbm_bpl = (nbits*w+7)/8;                        // bytes per scanline in PBM
+    pbm_bpl = (qsizetype(w) * nbits + 7) / 8;   // bytes per scanline in PBM
 
     if (raw) {                                // read raw data
         if (nbits == 32) {                        // type 6
@@ -225,14 +225,14 @@ static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, Q
                 if (device->read((char *)p, pbm_bpl) != pbm_bpl)
                     return false;
                 if (nbits == 8 && mcc < 255) {
-                    for (int i = 0; i < pbm_bpl; i++)
+                    for (qsizetype i = 0; i < pbm_bpl; i++)
                         p[i] = (p[i] * 255) / mcc;
                 }
             }
         }
     } else {                                        // read ascii data
         uchar *p;
-        int n;
+        qsizetype n;
         char buf;
         for (y = 0; (y < h) && (device->peek(&buf, 1) == 1); y++) {
             p = outImage->scanLine(y);
@@ -367,7 +367,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy
             str.append("255\n");
             if (out->write(str, str.length()) != str.length())
                 return false;
-            uint bpl = w * (gray ? 1 : 3);
+            qsizetype bpl = qsizetype(w) * (gray ? 1 : 3);
             uchar *buf = new uchar[bpl];
             if (image.format() == QImage::Format_Indexed8) {
                 QVector<QRgb> color = image.colorTable();
@@ -388,7 +388,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy
                             *p++ = qBlue(rgb);
                         }
                     }
-                    if (bpl != (uint)out->write((char*)buf, bpl))
+                    if (bpl != (qsizetype)out->write((char*)buf, bpl))
                         return false;
                 }
             } else {
@@ -407,7 +407,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy
                             *p++ = color;
                         }
                     }
-                    if (bpl != (uint)out->write((char*)buf, bpl))
+                    if (bpl != (qsizetype)out->write((char*)buf, bpl))
                         return false;
                 }
             }
@@ -420,7 +420,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy
             str.append("255\n");
             if (out->write(str, str.length()) != str.length())
                 return false;
-            uint bpl = w * 3;
+            qsizetype bpl = qsizetype(w) * 3;
             uchar *buf = new uchar[bpl];
             for (uint y=0; y<h; y++) {
                 const QRgb  *b = reinterpret_cast<const QRgb *>(image.constScanLine(y));
@@ -432,7 +432,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy
                     *p++ = qGreen(rgb);
                     *p++ = qBlue(rgb);
                 }
-                if (bpl != (uint)out->write((char*)buf, bpl))
+                if (bpl != (qsizetype)out->write((char*)buf, bpl))
                     return false;
             }
             delete [] buf;
diff --git a/src/gui/kernel/qplatformcursor.cpp b/src/gui/kernel/qplatformcursor.cpp
index 5a438a54a2..1330b5bf31 100644
--- a/src/gui/kernel/qplatformcursor.cpp
+++ b/src/gui/kernel/qplatformcursor.cpp
@@ -622,7 +622,7 @@ void QPlatformCursorImage::set(const uchar *data, const uchar *mask,
     int x = -1, w = 0;
 
     uchar *cursor_data = cursorImage.bits();
-    int bpl = cursorImage.bytesPerLine();
+    qsizetype bpl = cursorImage.bytesPerLine();
     for (int i = 0; i < height; i++)
     {
         for (int j = 0; j < bytesPerLine; j++, data++, mask++)
diff --git a/src/gui/painting/qbackingstore.cpp b/src/gui/painting/qbackingstore.cpp
index 2147d9d61d..5bbc03db80 100644
--- a/src/gui/painting/qbackingstore.cpp
+++ b/src/gui/painting/qbackingstore.cpp
@@ -322,7 +322,7 @@ void Q_GUI_EXPORT qt_scrollRectInImage(QImage &img, const QRect &rect, const QPo
     // make sure we don't detach
     uchar *mem = const_cast<uchar*>(const_cast<const QImage &>(img).bits());
 
-    int lineskip = img.bytesPerLine();
+    qsizetype lineskip = img.bytesPerLine();
     int depth = img.depth() >> 3;
 
     const QRect imageRect(0, 0, img.width(), img.height());
diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp
index 2d4045fe29..e4e8305620 100644
--- a/src/gui/painting/qdrawhelper.cpp
+++ b/src/gui/painting/qdrawhelper.cpp
@@ -2906,7 +2906,7 @@ static void QT_FASTCALL fetchTransformedBilinearARGB32PM_fast_rotate_helper(uint
         int32x4_t v_fdy = vdupq_n_s32(fdy * 4);
 
         const uchar *textureData = image.imageData;
-        const int bytesPerLine = image.bytesPerLine;
+        const qsizetype bytesPerLine = image.bytesPerLine;
 
         int32x4_t v_fx = vmovq_n_s32(fx);
         int32x4_t v_fy = vmovq_n_s32(fy);
diff --git a/src/gui/painting/qtextureglyphcache.cpp b/src/gui/painting/qtextureglyphcache.cpp
index 91214f27ca..e906397520 100644
--- a/src/gui/painting/qtextureglyphcache.cpp
+++ b/src/gui/painting/qtextureglyphcache.cpp
@@ -350,7 +350,7 @@ void QImageTextureGlyphCache::fillTexture(const Coord &c, glyph_t g, QFixed subP
         int mw = qMin(mask.width(), c.w);
         int mh = qMin(mask.height(), c.h);
         uchar *d = m_image.bits();
-        int dbpl = m_image.bytesPerLine();
+        qsizetype dbpl = m_image.bytesPerLine();
 
         for (int y = 0; y < c.h; ++y) {
             uchar *dest = d + (c.y + y) *dbpl + c.x/8;
@@ -372,7 +372,7 @@ void QImageTextureGlyphCache::fillTexture(const Coord &c, glyph_t g, QFixed subP
         int mw = qMin(mask.width(), c.w);
         int mh = qMin(mask.height(), c.h);
         uchar *d = m_image.bits();
-        int dbpl = m_image.bytesPerLine();
+        qsizetype dbpl = m_image.bytesPerLine();
 
         if (mask.depth() == 1) {
             for (int y = 0; y < c.h; ++y) {
diff --git a/src/gui/text/qfontengine.cpp b/src/gui/text/qfontengine.cpp
index 3ca9e9bbde..38814937f6 100644
--- a/src/gui/text/qfontengine.cpp
+++ b/src/gui/text/qfontengine.cpp
@@ -804,14 +804,14 @@ void QFontEngine::addBitmapFontToPath(qreal x, qreal y, const QGlyphLayout &glyp
 
         const int w = alphaMask.width();
         const int h = alphaMask.height();
-        const int srcBpl = alphaMask.bytesPerLine();
+        const qsizetype srcBpl = alphaMask.bytesPerLine();
         QImage bitmap;
         if (alphaMask.depth() == 1) {
             bitmap = alphaMask;
         } else {
             bitmap = QImage(w, h, QImage::Format_Mono);
             const uchar *imageData = alphaMask.bits();
-            const int destBpl = bitmap.bytesPerLine();
+            const qsizetype destBpl = bitmap.bytesPerLine();
             uchar *bitmapData = bitmap.bits();
 
             for (int yi = 0; yi < h; ++yi) {
diff --git a/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp b/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp
index ca50910114..511d85a400 100644
--- a/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp
+++ b/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp
@@ -385,7 +385,7 @@ GLuint QPlatformBackingStoreOpenGLSupport::toTexture(const QRegion &dirtyRegion,
     // The image provided by the backingstore may have a stride larger than width * 4, for
     // instance on platforms that manually implement client-side decorations.
     static const int bytesPerPixel = 4;
-    const int strideInPixels = image.bytesPerLine() / bytesPerPixel;
+    const qsizetype strideInPixels = image.bytesPerLine() / bytesPerPixel;
     const bool hasUnpackRowLength = !ctx->isOpenGLES() || ctx->format().majorVersion() >= 3;
 
     QOpenGLFunctions *funcs = ctx->functions();
diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp
index c92cc3ea61..a672e92006 100644
--- a/src/plugins/imageformats/gif/qgifhandler.cpp
+++ b/src/plugins/imageformats/gif/qgifhandler.cpp
@@ -246,7 +246,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
     }
 
     image->detach();
-    int bpl = image->bytesPerLine();
+    qsizetype bpl = image->bytesPerLine();
     unsigned char *bits = image->bits();
 
 #define LM(l, m) (((m)<<8)|l)
@@ -422,7 +422,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
                         }
                         memset(backingstore.bits(), 0, backingstore.sizeInBytes());
                     }
-                    const int dest_bpl = backingstore.bytesPerLine();
+                    const qsizetype dest_bpl = backingstore.bytesPerLine();
                     unsigned char *dest_data = backingstore.bits();
                     for (int ln=0; ln<h; ln++) {
                         memcpy(FAST_SCAN_LINE(dest_data, dest_bpl, ln),
diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp
index eb50f52bd6..1982e05344 100644
--- a/src/plugins/imageformats/ico/qicohandler.cpp
+++ b/src/plugins/imageformats/ico/qicohandler.cpp
@@ -356,7 +356,7 @@ void ICOReader::read1BitBMP(QImage & image)
     if (iod) {
 
         int h = image.height();
-        int bpl = image.bytesPerLine();
+        qsizetype bpl = image.bytesPerLine();
 
         while (--h >= 0) {
             if (iod->read((char*)image.scanLine(h),bpl) != bpl) {
@@ -405,7 +405,7 @@ void ICOReader::read8BitBMP(QImage & image)
     if (iod) {
 
         int h = icoAttrib.h;
-        int bpl = image.bytesPerLine();
+        qsizetype bpl = image.bytesPerLine();
 
         while (--h >= 0) {
             if (iod->read((char *)image.scanLine(h), bpl) != bpl) {
@@ -425,7 +425,7 @@ void ICOReader::read16_24_32BMP(QImage & image)
         QRgb *p;
         QRgb  *end;
         uchar *buf = new uchar[image.bytesPerLine()];
-        int    bpl = ((icoAttrib.w*icoAttrib.nbits+31)/32)*4;
+        qsizetype    bpl = ((qsizetype(icoAttrib.w)*icoAttrib.nbits+31)/32)*4;
         uchar *b;
 
         while (--h >= 0) {
diff --git a/src/plugins/platforms/cocoa/qpaintengine_mac.mm b/src/plugins/platforms/cocoa/qpaintengine_mac.mm
index 00b2267f0d..cadb76d2e4 100644
--- a/src/plugins/platforms/cocoa/qpaintengine_mac.mm
+++ b/src/plugins/platforms/cocoa/qpaintengine_mac.mm
@@ -90,7 +90,7 @@ CGImageRef qt_mac_create_imagemask(const QPixmap &pixmap, const QRectF &sr)
         image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied);
 
     const int sx = qRound(sr.x()), sy = qRound(sr.y()), sw = qRound(sr.width()), sh = qRound(sr.height());
-    const int sbpr = image.bytesPerLine();
+    const qsizetype sbpr = image.bytesPerLine();
     const uint nbytes = sw * sh;
     //  alpha is always 255 for bitmaps, ignore it in this case.
     const quint32 mask = pixmap.depth() == 1 ? 0x00ffffff : 0xffffffff;
diff --git a/src/plugins/platforms/vnc/qvnc.cpp b/src/plugins/platforms/vnc/qvnc.cpp
index 8390fa19cd..aea8d26983 100644
--- a/src/plugins/platforms/vnc/qvnc.cpp
+++ b/src/plugins/platforms/vnc/qvnc.cpp
@@ -502,7 +502,7 @@ void QRfbRawEncoder::write()
         const quint32 encoding = htonl(0); // raw encoding
         socket->write((char *)&encoding, sizeof(encoding));
 
-        int linestep = screenImage.bytesPerLine();
+        qsizetype linestep = screenImage.bytesPerLine();
         const uchar *screendata = screenImage.scanLine(rect.y)
                                   + rect.x * screenImage.depth() / 8;
 
diff --git a/src/plugins/platforms/windows/qwindowsmime.cpp b/src/plugins/platforms/windows/qwindowsmime.cpp
index fe9e1fe31f..9bc79a10f9 100644
--- a/src/plugins/platforms/windows/qwindowsmime.cpp
+++ b/src/plugins/platforms/windows/qwindowsmime.cpp
@@ -149,7 +149,10 @@ static bool qt_write_dibv5(QDataStream &s, QImage image)
         return false;
 
     //depth will be always 32
-    int bpl_bmp = image.width()*4;
+    qsizetype bpl_bmp = qsizetype(image.width()) * 4;
+    qsizetype size = bpl_bmp * image.height();
+    if (qsizetype(DWORD(size)) != size)
+        return false;
 
     BMP_BITMAPV5HEADER bi;
     ZeroMemory(&bi, sizeof(bi));
@@ -261,11 +264,11 @@ static bool qt_read_dibv5(QDataStream &s, QImage &image)
     const int blue_shift = calc_shift(blue_mask);
     const int alpha_shift =  alpha_mask ? calc_shift(alpha_mask) : 0u;
 
-    const int  bpl = image.bytesPerLine();
+    const qsizetype  bpl = image.bytesPerLine();
     uchar *data = image.bits();
 
     auto *buf24 = new uchar[bpl];
-    const int bpl24 = ((w * nbits + 31) / 32) * 4;
+    const qsizetype bpl24 = ((qsizetype(w) * nbits + 31) / 32) * 4;
 
     while (--h >= 0) {
         QRgb *p = reinterpret_cast<QRgb *>(data + h * bpl);
diff --git a/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp b/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp
index 82b6d60bcd..7bf2b38d7d 100644
--- a/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp
+++ b/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp
@@ -2016,7 +2016,7 @@ Q_GUI_EXPORT void qt_x11_drawImage(const QRect &rect, const QPoint &pos, const Q
         || (image_byte_order == LSBFirst && bgr_layout))
     {
         im = image.copy(rect);
-        const int iw = im.bytesPerLine() / 4;
+        const qsizetype iw = im.bytesPerLine() / 4;
         uint *data = (uint *)im.bits();
         for (int i=0; i < h; i++) {
             uint *p = data;
diff --git a/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp b/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp
index f86bedbdcd..467e93e64f 100644
--- a/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp
+++ b/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp
@@ -1747,7 +1747,7 @@ XID QX11PlatformPixmap::createBitmapFromImage(const QImage &image)
     int w = img.width();
     int h = img.height();
     int bpl = (w + 7) / 8;
-    int ibpl = img.bytesPerLine();
+    qsizetype ibpl = img.bytesPerLine();
     if (bpl != ibpl) {
         tmp_bits = new uchar[bpl*h];
         bits = (char *)tmp_bits;
@@ -2017,7 +2017,7 @@ QImage QX11PlatformPixmap::toImage(const QXImageWrapper &xiWrapper, const QRect
         }
     } else if (xi->bits_per_pixel == d) {        // compatible depth
         char *xidata = xi->data;                // copy each scanline
-        int bpl = qMin(int(image.bytesPerLine()),xi->bytes_per_line);
+        qsizetype bpl = qMin(image.bytesPerLine(),xi->bytes_per_line);
         for (int y=0; y<xi->height; y++) {
             memcpy(image.scanLine(y), xidata, bpl);
             xidata += xi->bytes_per_line;
@@ -2038,10 +2038,10 @@ QImage QX11PlatformPixmap::toImage(const QXImageWrapper &xiWrapper, const QRect
         uchar *end;
         uchar  use[256];                        // pixel-in-use table
         uchar  pix[256];                        // pixel translation table
-        int    ncols, bpl;
+        int    ncols;
         memset(use, 0, 256);
         memset(pix, 0, 256);
-        bpl = image.bytesPerLine();
+        qsizetype bpl = image.bytesPerLine();
 
         if (x11_mask) {                         // which pixels are used?
             for (int i = 0; i < xi->height; i++) {
diff --git a/src/plugins/platforms/xcb/qxcbbackingstore.cpp b/src/plugins/platforms/xcb/qxcbbackingstore.cpp
index 8f55bc2e96..7330c3c9a3 100644
--- a/src/plugins/platforms/xcb/qxcbbackingstore.cpp
+++ b/src/plugins/platforms/xcb/qxcbbackingstore.cpp
@@ -537,7 +537,7 @@ void QXcbBackingStoreImage::ensureGC(xcb_drawable_t dst)
 static inline void copy_unswapped(char *dst, int dstBytesPerLine, const QImage &img, const QRect &rect)
 {
     const uchar *srcData = img.constBits();
-    const int srcBytesPerLine = img.bytesPerLine();
+    const qsizetype srcBytesPerLine = img.bytesPerLine();
 
     const int leftOffset = rect.left() * img.depth() >> 3;
     const int bottom = rect.bottom() + 1;
@@ -553,7 +553,7 @@ template <class Pixel>
 static inline void copy_swapped(char *dst, const int dstStride, const QImage &img, const QRect &rect)
 {
     const uchar *srcData = img.constBits();
-    const int srcBytesPerLine = img.bytesPerLine();
+    const qsizetype srcBytesPerLine = img.bytesPerLine();
 
     const int left = rect.left();
     const int width = rect.width();
diff --git a/src/plugins/platforms/xcb/qxcbimage.cpp b/src/plugins/platforms/xcb/qxcbimage.cpp
index b0e610dd51..5b5c37fac4 100644
--- a/src/plugins/platforms/xcb/qxcbimage.cpp
+++ b/src/plugins/platforms/xcb/qxcbimage.cpp
@@ -212,7 +212,7 @@ xcb_pixmap_t qt_xcb_XPixmapFromBitmap(QXcbScreen *screen, const QImage &image)
     }
     const int width = bitmap.width();
     const int height = bitmap.height();
-    const int bytesPerLine = bitmap.bytesPerLine();
+    const qsizetype bytesPerLine = bitmap.bytesPerLine();
     int destLineSize = width / 8;
     if (width % 8)
         ++destLineSize;
diff --git a/src/plugins/styles/mac/qmacstyle_mac.mm b/src/plugins/styles/mac/qmacstyle_mac.mm
index e2599e8c6b..d45ee1a694 100644
--- a/src/plugins/styles/mac/qmacstyle_mac.mm
+++ b/src/plugins/styles/mac/qmacstyle_mac.mm
@@ -2766,12 +2766,12 @@ int QMacStyle::styleHint(StyleHint sh, const QStyleOption *opt, const QWidget *w
             }
 
             const QRgb *sptr = (QRgb*)img.bits(), *srow;
-            const int sbpl = img.bytesPerLine();
+            const qsizetype sbpl = img.bytesPerLine();
             const int w = sbpl/4, h = img.height();
 
             QImage img_mask(img.width(), img.height(), QImage::Format_ARGB32);
             QRgb *dptr = (QRgb*)img_mask.bits(), *drow;
-            const int dbpl = img_mask.bytesPerLine();
+            const qsizetype dbpl = img_mask.bytesPerLine();
 
             for (int y = 0; y < h; ++y) {
                 srow = sptr+((y*sbpl)/4);
diff --git a/src/widgets/effects/qpixmapfilter.cpp b/src/widgets/effects/qpixmapfilter.cpp
index 1f899c2660..705871719f 100644
--- a/src/widgets/effects/qpixmapfilter.cpp
+++ b/src/widgets/effects/qpixmapfilter.cpp
@@ -784,11 +784,11 @@ Q_WIDGETS_EXPORT QImage qt_halfScaled(const QImage &source)
         dest.setDevicePixelRatio(source.devicePixelRatioF());
 
         const uchar *src = reinterpret_cast<const uchar*>(const_cast<const QImage &>(srcImage).bits());
-        int sx = srcImage.bytesPerLine();
-        int sx2 = sx << 1;
+        qsizetype sx = srcImage.bytesPerLine();
+        qsizetype sx2 = sx << 1;
 
         uchar *dst = reinterpret_cast<uchar*>(dest.bits());
-        int dx = dest.bytesPerLine();
+        qsizetype dx = dest.bytesPerLine();
         int ww = dest.width();
         int hh = dest.height();
 
@@ -806,11 +806,11 @@ Q_WIDGETS_EXPORT QImage qt_halfScaled(const QImage &source)
         dest.setDevicePixelRatio(source.devicePixelRatioF());
 
         const uchar *src = reinterpret_cast<const uchar*>(const_cast<const QImage &>(srcImage).bits());
-        int sx = srcImage.bytesPerLine();
-        int sx2 = sx << 1;
+        qsizetype sx = srcImage.bytesPerLine();
+        qsizetype sx2 = sx << 1;
 
         uchar *dst = reinterpret_cast<uchar*>(dest.bits());
-        int dx = dest.bytesPerLine();
+        qsizetype dx = dest.bytesPerLine();
         int ww = dest.width();
         int hh = dest.height();
 
@@ -843,11 +843,11 @@ Q_WIDGETS_EXPORT QImage qt_halfScaled(const QImage &source)
     dest.setDevicePixelRatio(source.devicePixelRatioF());
 
     const quint32 *src = reinterpret_cast<const quint32*>(const_cast<const QImage &>(srcImage).bits());
-    int sx = srcImage.bytesPerLine() >> 2;
-    int sx2 = sx << 1;
+    qsizetype sx = srcImage.bytesPerLine() >> 2;
+    qsizetype sx2 = sx << 1;
 
     quint32 *dst = reinterpret_cast<quint32*>(dest.bits());
-    int dx = dest.bytesPerLine() >> 2;
+    qsizetype dx = dest.bytesPerLine() >> 2;
     int ww = dest.width();
     int hh = dest.height();
 
diff --git a/src/widgets/styles/qstyleanimation.cpp b/src/widgets/styles/qstyleanimation.cpp
index b9202eae69..1c1158ab10 100644
--- a/src/widgets/styles/qstyleanimation.cpp
+++ b/src/widgets/styles/qstyleanimation.cpp
@@ -266,7 +266,7 @@ static QImage blendedImage(const QImage &start, const QImage &end, float alpha)
     const int ia = 256 - a;
     const int sw = start.width();
     const int sh = start.height();
-    const int bpl = start.bytesPerLine();
+    const qsizetype bpl = start.bytesPerLine();
     switch (start.depth()) {
     case 32:
         {
diff --git a/src/widgets/widgets/qeffects.cpp b/src/widgets/widgets/qeffects.cpp
index ee4095cb36..5cb8bb3c50 100644
--- a/src/widgets/widgets/qeffects.cpp
+++ b/src/widgets/widgets/qeffects.cpp
@@ -305,7 +305,7 @@ void QAlphaWidget::alphaBlend()
 
     const int sw = frontImage.width();
     const int sh = frontImage.height();
-    const int bpl = frontImage.bytesPerLine();
+    const qsizetype bpl = frontImage.bytesPerLine();
     switch(frontImage.depth()) {
     case 32:
         {
diff --git a/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp b/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp
index aaa8475c74..247f6443c1 100644
--- a/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp
+++ b/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp
@@ -94,8 +94,8 @@ private:
 
 static void initializePadding(QImage *image)
 {
-    int effectiveBytesPerLine = (image->width() * image->depth() + 7) / 8;
-    int paddingBytes = image->bytesPerLine() - effectiveBytesPerLine;
+    qsizetype effectiveBytesPerLine = (qsizetype(image->width()) * image->depth() + 7) / 8;
+    qsizetype paddingBytes = image->bytesPerLine() - effectiveBytesPerLine;
     if (paddingBytes == 0)
         return;
     for (int y = 0; y < image->height(); ++y) {
diff --git a/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp b/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp
index 485a0b0f93..bd287eb225 100644
--- a/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp
+++ b/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp
@@ -2136,7 +2136,7 @@ void tst_QTextEdit::compareWidgetAndImage(QTextEdit &widget, const QString &imag
     QCOMPARE(image.depth(), 32);
     QCOMPARE(original.depth(), image.depth());
 
-    const int bytesPerLine = image.bytesPerLine();
+    const qsizetype bytesPerLine = image.bytesPerLine();
     const int width = image.width();
     const int height = image.height();
 
diff --git a/tests/baselineserver/shared/baselineprotocol.cpp b/tests/baselineserver/shared/baselineprotocol.cpp
index 9e5321cb1b..d11369f3d2 100644
--- a/tests/baselineserver/shared/baselineprotocol.cpp
+++ b/tests/baselineserver/shared/baselineprotocol.cpp
@@ -223,8 +223,8 @@ quint32       *pb);       /* IN: more seed OUT: secondary hash value */
 quint64 ImageItem::computeChecksum(const QImage &image)
 {
     QImage img(image);
-    const int bpl = img.bytesPerLine();
-    const int padBytes = bpl - (img.width() * img.depth() / 8);
+    const qsizetype bpl = img.bytesPerLine();
+    const int padBytes = bpl - (qsizetype(img.width()) * img.depth() / 8);
     if (padBytes) {
         uchar *p = img.bits() + bpl - padBytes;
         const int h = img.height();