Merge remote-tracking branch 'origin/5.13' into dev

Change-Id: I38389a69411f4549fed432f1181dbe23398b34a2

4 files changed, 23 insertions, 3 deletions

diff --git a/src/gui/image/qiconloader.cpp b/src/gui/image/qiconloader.cpp
index a9adde8c8d..1d0c93f26f 100644
--- a/src/gui/image/qiconloader.cpp
+++ b/src/gui/image/qiconloader.cpp
@@ -629,7 +629,10 @@ void QIconLoaderEngine::ensureLoaded()
 void QIconLoaderEngine::paint(QPainter *painter, const QRect &rect,
                              QIcon::Mode mode, QIcon::State state)
 {
-    QSize pixmapSize = rect.size();
+    const qreal dpr = !qApp->testAttribute(Qt::AA_UseHighDpiPixmaps) ?
+                qreal(1.0) : painter->device()->devicePixelRatioF();
+
+    QSize pixmapSize = rect.size() * dpr;
     painter->drawPixmap(rect, pixmap(pixmapSize, mode, state));
 }
 
diff --git a/src/gui/image/qimage.cpp b/src/gui/image/qimage.cpp
index 18125460c7..a6ac3bc333 100644
--- a/src/gui/image/qimage.cpp
+++ b/src/gui/image/qimage.cpp
@@ -127,7 +127,7 @@ QImageData * QImageData::create(const QSize &size, QImage::Format format)
     int height = size.height();
     int depth = qt_depthForFormat(format);
     auto params = calculateImageParameters(width, height, depth);
-    if (params.bytesPerLine < 0)
+    if (!params.isValid())
         return nullptr;
 
     QScopedPointer<QImageData> d(new QImageData);
@@ -786,7 +786,7 @@ QImageData *QImageData::create(uchar *data, int width, int height,  int bpl, QIm
 
     const int depth = qt_depthForFormat(format);
     auto params = calculateImageParameters(width, height, depth);
-    if (params.totalSize < 0)
+    if (!params.isValid())
         return nullptr;
 
     if (bpl > 0) {
@@ -1492,10 +1492,17 @@ qsizetype QImage::sizeInBytes() const
 
     \sa scanLine()
 */
+#if QT_VERSION >= QT_VERSION_CHECK(6,0,0)
+qsizetype QImage::bytesPerLine() const
+{
+    return d ? d->bytes_per_line : 0;
+}
+#else
 int QImage::bytesPerLine() const
 {
     return d ? d->bytes_per_line : 0;
 }
+#endif
 
 
 /*!
diff --git a/src/gui/image/qimage.h b/src/gui/image/qimage.h
index b09e69c839..af7e6988cb 100644
--- a/src/gui/image/qimage.h
+++ b/src/gui/image/qimage.h
@@ -228,7 +228,11 @@ public:
     uchar *scanLine(int);
     const uchar *scanLine(int) const;
     const uchar *constScanLine(int) const;
+#if QT_VERSION >= QT_VERSION_CHECK(6,0,0)
+    qsizetype bytesPerLine() const;
+#else
     int bytesPerLine() const;
+#endif
 
     bool valid(int x, int y) const;
     bool valid(const QPoint &pt) const;
diff --git a/src/gui/image/qimage_p.h b/src/gui/image/qimage_p.h
index 1e0578a0f4..9da6acd0a7 100644
--- a/src/gui/image/qimage_p.h
+++ b/src/gui/image/qimage_p.h
@@ -113,6 +113,7 @@ struct Q_GUI_EXPORT QImageData {        // internal image data
     struct ImageSizeParameters {
         qsizetype bytesPerLine;
         qsizetype totalSize;
+        bool isValid() const { return bytesPerLine > 0 && totalSize > 0; }
     };
     static ImageSizeParameters calculateImageParameters(qsizetype width, qsizetype height, qsizetype depth);
 };
@@ -139,6 +140,11 @@ QImageData::calculateImageParameters(qsizetype width, qsizetype height, qsizetyp
     qsizetype dummy;
     if (mul_overflow(height, qsizetype(sizeof(uchar *)), &dummy))
         return invalid;                                 // why is this here?
+#if QT_VERSION < QT_VERSION_CHECK(6,0,0)
+    // Disallow images where width * depth calculations might overflow
+    if (width > (INT_MAX - 31) / depth)
+        return invalid;
+#endif
 
     return { bytes_per_line, total_size };
 }