summaryrefslogtreecommitdiffstats
path: root/src/gui
diff options
context:
space:
mode:
authorQt Forward Merge Bot <qt_forward_merge_bot@qt-project.org>2018-09-16 01:00:13 +0200
committerQt Forward Merge Bot <qt_forward_merge_bot@qt-project.org>2018-09-16 01:00:13 +0200
commit4e0fcc6ffc2840f08478410a6f90c3044af247b3 (patch)
tree1442b0919f09d9fc6f7e02fd3a0ab783aefe265b /src/gui
parent6723155bc768790f14d97a61b74b01e7465ba199 (diff)
parent6bb0cbc6865911c31f5edee7c24f270d265bd46d (diff)
Merge remote-tracking branch 'origin/5.12' into dev
Diffstat (limited to 'src/gui')
-rw-r--r--src/gui/image/qbmphandler.cpp2
-rw-r--r--src/gui/image/qimage.h2
2 files changed, 3 insertions, 1 deletions
diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
index 587f375ce7..5dff4ab0ac 100644
--- a/src/gui/image/qbmphandler.cpp
+++ b/src/gui/image/qbmphandler.cpp
@@ -188,6 +188,8 @@ static bool read_dib_infoheader(QDataStream &s, BMP_INFOHDR &bi)
if (!(comp == BMP_RGB || (nbits == 4 && comp == BMP_RLE4) ||
(nbits == 8 && comp == BMP_RLE8) || ((nbits == 16 || nbits == 32) && comp == BMP_BITFIELDS)))
return false; // weird compression type
+ if (bi.biWidth < 0 || quint64(bi.biWidth) * qAbs(bi.biHeight) > 16384 * 16384)
+ return false;
return true;
}
diff --git a/src/gui/image/qimage.h b/src/gui/image/qimage.h
index 7764c19452..4b7a3b1ead 100644
--- a/src/gui/image/qimage.h
+++ b/src/gui/image/qimage.h
@@ -334,7 +334,7 @@ public:
static QPixelFormat toPixelFormat(QImage::Format format) Q_DECL_NOTHROW;
static QImage::Format toImageFormat(QPixelFormat format) Q_DECL_NOTHROW;
- // Platform spesific conversion functions
+ // Platform specific conversion functions
#if defined(Q_OS_DARWIN) || defined(Q_QDOC)
CGImageRef toCGImage() const Q_DECL_CF_RETURNS_RETAINED;
#endif