diff options
author | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2019-02-11 10:52:06 +0100 |
---|---|---|
committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2019-02-14 07:48:38 +0000 |
commit | a5cded843f495b4276a8289b1324778d97bed5ba (patch) | |
tree | 1e4a04ea1349dbc522fcf9b2dd6eef2e1d4036c0 /src/gui/image/qimage_p.h | |
parent | 81fd7f4c8af260d753a834480f790c82fb161889 (diff) |
Avoid creating wide images with negative bytesPerLine
The QImage API can not handle images with more bytes per line than what
an integer can hold.
Fixes: QTBUG-73731
Fixes: QTBUG-73732
Change-Id: Ieed6fec7645661fd58d8d25335f806faaa1bb3e9
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Diffstat (limited to 'src/gui/image/qimage_p.h')
-rw-r--r-- | src/gui/image/qimage_p.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/gui/image/qimage_p.h b/src/gui/image/qimage_p.h index e3a6c53833..a0a3b5406e 100644 --- a/src/gui/image/qimage_p.h +++ b/src/gui/image/qimage_p.h @@ -109,6 +109,7 @@ struct Q_GUI_EXPORT QImageData { // internal image data struct ImageSizeParameters { qsizetype bytesPerLine; qsizetype totalSize; + bool isValid() const { return bytesPerLine > 0 && totalSize > 0; } }; static ImageSizeParameters calculateImageParameters(qsizetype width, qsizetype height, qsizetype depth); }; @@ -135,6 +136,11 @@ QImageData::calculateImageParameters(qsizetype width, qsizetype height, qsizetyp qsizetype dummy; if (mul_overflow(height, qsizetype(sizeof(uchar *)), &dummy)) return invalid; // why is this here? +#if QT_VERSION < QT_VERSION_CHECK(6,0,0) + // Disallow images where width * depth calculations might overflow + if (width > (INT_MAX - 31) / depth) + return invalid; +#endif return { bytes_per_line, total_size }; } |