summaryrefslogtreecommitdiffstats
path: root/src/plugins/imageformats/ico
diff options
context:
space:
mode:
authorRobert Löhning <robert.loehning@qt.io>2022-02-25 20:26:59 +0100
committerRobert Löhning <robert.loehning@qt.io>2022-03-02 14:58:10 +0100
commit27fae7207fabc5bd5e34beab0cfeedfc8b8ede78 (patch)
tree18d69b3aca0257657e6c3403fc5389a332ff9bf0 /src/plugins/imageformats/ico
parent38a86afcc4e7ad64278a954cbd97edc92b38c06a (diff)
png/ico decoder: Don't try reading beyond the file
This fixes oss-fuzz issue 44955. Pick-to: 6.2 6.3 Change-Id: Ie74ae037630f83e64fd0678ff2eac579f35d02b8 Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org> Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
Diffstat (limited to 'src/plugins/imageformats/ico')
-rw-r--r--src/plugins/imageformats/ico/qicohandler.cpp6
1 files changed, 4 insertions, 2 deletions
diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp
index a3fe9d740c..e1811e861d 100644
--- a/src/plugins/imageformats/ico/qicohandler.cpp
+++ b/src/plugins/imageformats/ico/qicohandler.cpp
@@ -1,6 +1,6 @@
/****************************************************************************
**
-** Copyright (C) 2016 The Qt Company Ltd.
+** Copyright (C) 2022 The Qt Company Ltd.
** Contact: https://www.qt.io/licensing/
**
** This file is part of the plugins of the Qt Toolkit.
@@ -466,7 +466,9 @@ QImage ICOReader::iconAt(int index)
static const uchar pngMagicData[] = { 137, 80, 78, 71, 13, 10, 26, 10 };
- iod->seek(iconEntry.dwImageOffset);
+ if (!iod->seek(iconEntry.dwImageOffset)
+ || iconEntry.dwBytesInRes > iod->bytesAvailable())
+ return img;
const QByteArray pngMagic = QByteArray::fromRawData((const char*)pngMagicData, sizeof(pngMagicData));
const bool isPngImage = (iod->read(pngMagic.size()) == pngMagic);