diff options
author | Robert Löhning <robert.loehning@qt.io> | 2022-02-25 20:26:59 +0100 |
---|---|---|
committer | Robert Löhning <robert.loehning@qt.io> | 2022-03-02 14:58:10 +0100 |
commit | 27fae7207fabc5bd5e34beab0cfeedfc8b8ede78 (patch) | |
tree | 18d69b3aca0257657e6c3403fc5389a332ff9bf0 /src/plugins/imageformats/ico | |
parent | 38a86afcc4e7ad64278a954cbd97edc92b38c06a (diff) |
png/ico decoder: Don't try reading beyond the file
This fixes oss-fuzz issue 44955.
Pick-to: 6.2 6.3
Change-Id: Ie74ae037630f83e64fd0678ff2eac579f35d02b8
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
Diffstat (limited to 'src/plugins/imageformats/ico')
-rw-r--r-- | src/plugins/imageformats/ico/qicohandler.cpp | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp index a3fe9d740c..e1811e861d 100644 --- a/src/plugins/imageformats/ico/qicohandler.cpp +++ b/src/plugins/imageformats/ico/qicohandler.cpp @@ -1,6 +1,6 @@ /**************************************************************************** ** -** Copyright (C) 2016 The Qt Company Ltd. +** Copyright (C) 2022 The Qt Company Ltd. ** Contact: https://www.qt.io/licensing/ ** ** This file is part of the plugins of the Qt Toolkit. @@ -466,7 +466,9 @@ QImage ICOReader::iconAt(int index) static const uchar pngMagicData[] = { 137, 80, 78, 71, 13, 10, 26, 10 }; - iod->seek(iconEntry.dwImageOffset); + if (!iod->seek(iconEntry.dwImageOffset) + || iconEntry.dwBytesInRes > iod->bytesAvailable()) + return img; const QByteArray pngMagic = QByteArray::fromRawData((const char*)pngMagicData, sizeof(pngMagicData)); const bool isPngImage = (iod->read(pngMagic.size()) == pngMagic); |