diff options
| author | Friedemann Kleint <Friedemann.Kleint@qt.io> | 2018-12-12 10:46:32 +0100 |
|---|---|---|
| committer | Friedemann Kleint <Friedemann.Kleint@qt.io> | 2018-12-12 16:08:10 +0000 |
| commit | d1cafa3ebac00f60cab3ca2beed6ebf2e6579a94 (patch) | |
| tree | ab324285e68defa3c1641337ca21dd741e01e890 /src/gui/image/qpixmap_win.cpp | |
| parent | ceebad9bd2c5ca35c09a17b0adc5e8ee140bdad2 (diff) | |
qt_imageFromWinHBITMAP(): Fix memory corruption when converting from bitmaps with low depths
Insufficient memory was allocated when asking GetDIBits() to convert to 32bit.
Fix allocation size and use a QScopedArrayPointer.
Fixes: QTBUG-72343
Change-Id: I45f79c913a243316e01bc6efed08e50ccc7d25f4
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
Diffstat (limited to 'src/gui/image/qpixmap_win.cpp')
| -rw-r--r-- | src/gui/image/qpixmap_win.cpp | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/gui/image/qpixmap_win.cpp b/src/gui/image/qpixmap_win.cpp index b8d13ac092..b5f8d43041 100644 --- a/src/gui/image/qpixmap_win.cpp +++ b/src/gui/image/qpixmap_win.cpp @@ -422,8 +422,11 @@ static QImage imageFromWinHBITMAP_GetDiBits(HBITMAP bitmap, bool forceQuads, int if (info.bmiHeader.biHeight > 0) // Force top-down info.bmiHeader.biHeight = -info.bmiHeader.biHeight; info.bmiHeader.biCompression = BI_RGB; // Extract using no compression (can be BI_BITFIELD) - if (forceQuads) + size_t allocSize = info.bmiHeader.biSizeImage; + if (forceQuads) { info.bmiHeader.biBitCount = 32; + allocSize = info.bmiHeader.biWidth * qAbs(info.bmiHeader.biHeight) * 4; + } const QImage::Format imageFormat = imageFromWinHBITMAP_Format(info.bmiHeader, hbitmapFormat); if (imageFormat == QImage::Format_Invalid) { @@ -431,7 +434,7 @@ static QImage imageFromWinHBITMAP_GetDiBits(HBITMAP bitmap, bool forceQuads, int return QImage(); } - QScopedPointer<uchar> data(new uchar[info.bmiHeader.biSizeImage]); + QScopedArrayPointer<uchar> data(new uchar[allocSize]); if (!GetDIBits(displayDc, bitmap, 0, qAbs(info.bmiHeader.biHeight), data.data(), &info, DIB_RGB_COLORS)) { qErrnoWarning("%s: GetDIBits() failed to get data.", __FUNCTION__); return QImage(); |