Merge remote-tracking branch 'origin/5.13' into dev

Change-Id: I38389a69411f4549fed432f1181dbe23398b34a2

1 files changed, 6 insertions, 0 deletions

diff --git a/src/gui/image/qimage_p.h b/src/gui/image/qimage_p.h
index 1e0578a0f4..9da6acd0a7 100644
--- a/src/gui/image/qimage_p.h
+++ b/src/gui/image/qimage_p.h
@@ -113,6 +113,7 @@ struct Q_GUI_EXPORT QImageData {        // internal image data
     struct ImageSizeParameters {
         qsizetype bytesPerLine;
         qsizetype totalSize;
+        bool isValid() const { return bytesPerLine > 0 && totalSize > 0; }
     };
     static ImageSizeParameters calculateImageParameters(qsizetype width, qsizetype height, qsizetype depth);
 };
@@ -139,6 +140,11 @@ QImageData::calculateImageParameters(qsizetype width, qsizetype height, qsizetyp
     qsizetype dummy;
     if (mul_overflow(height, qsizetype(sizeof(uchar *)), &dummy))
         return invalid;                                 // why is this here?
+#if QT_VERSION < QT_VERSION_CHECK(6,0,0)
+    // Disallow images where width * depth calculations might overflow
+    if (width > (INT_MAX - 31) / depth)
+        return invalid;
+#endif
 
     return { bytes_per_line, total_size };
 }