diff options
author | Qt Forward Merge Bot <qt_forward_merge_bot@qt-project.org> | 2020-05-14 14:01:32 +0200 |
---|---|---|
committer | Qt Forward Merge Bot <qt_forward_merge_bot@qt-project.org> | 2020-05-14 14:01:32 +0200 |
commit | 76fe36645eb41fa35e526a97874f1e15a39c3823 (patch) | |
tree | aea94a0ee4fbd3e7187666999d3b9b825c7a43af /src/gui | |
parent | d68f3a81c9073c64e4492dfca33eeafccb460c6f (diff) | |
parent | ba3b53cb501a77144aa6259e48a8e0edc3d1481d (diff) |
Merge remote-tracking branch 'origin/5.15.0' into 5.15
Change-Id: I06396fa0a3d1687a0935e48d290358edbb0e59e8
Diffstat (limited to 'src/gui')
-rw-r--r-- | src/gui/painting/qicc.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/gui/painting/qicc.cpp b/src/gui/painting/qicc.cpp index 2b5cd58fb1..b7c8e8f824 100644 --- a/src/gui/painting/qicc.cpp +++ b/src/gui/painting/qicc.cpp @@ -225,7 +225,7 @@ static bool isValidIccProfile(const ICCProfileHeader &header) } // Don't overflow 32bit integers: - if (header.tagCount >= INT32_MAX / sizeof(TagTableEntry)) { + if (header.tagCount >= (INT32_MAX - sizeof(ICCProfileHeader)) / sizeof(TagTableEntry)) { qCWarning(lcIcc, "Failed tag count sanity"); return false; } @@ -629,6 +629,7 @@ bool fromIccProfile(const QByteArray &data, QColorSpace *colorSpace) // Read tag index const TagTableEntry *tagTable = (const TagTableEntry *)(data.constData() + sizeof(ICCProfileHeader)); const qsizetype offsetToData = sizeof(ICCProfileHeader) + header->tagCount * sizeof(TagTableEntry); + Q_ASSERT(offsetToData > 0); if (offsetToData > data.size()) { qCWarning(lcIcc) << "fromIccProfile: failed index size sanity"; return false; |