diff options
author | Lars Knoll <lars.knoll@digia.com> | 2014-04-24 15:33:27 +0200 |
---|---|---|
committer | The Qt Project <gerrit-noreply@qt-project.org> | 2014-04-25 01:43:21 +0200 |
commit | eb1325047f2697d24e93ebaf924900affc876bc1 (patch) | |
tree | 84311c797239b2c590f49d7cc3c17b653ef0d7b9 /src | |
parent | e57b521d950575a96d54e6944ab153a9505e51f7 (diff) |
Don't crash on broken GIF images
Broken GIF images could set invalid width and height
values inside the image, leading to Qt creating a null
QImage for it. In that case we need to abort decoding
the image and return an error.
Initial patch by Rich Moore.
Task-number: QTBUG-38367
Change-Id: Id82a4036f478bd6e49c402d6598f57e7e5bb5e1e
Security-advisory: CVE-2014-0190
Reviewed-by: Richard J. Moore <rich@kde.org>
Diffstat (limited to 'src')
-rw-r--r-- | src/gui/image/qgifhandler.cpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp index eeb62af4e5..19b838240f 100644 --- a/src/gui/image/qgifhandler.cpp +++ b/src/gui/image/qgifhandler.cpp @@ -359,6 +359,13 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, memset(bits, 0, image->byteCount()); } + // Check if the previous attempt to create the image failed. If it + // did then the image is broken and we should give up. + if (image->isNull()) { + state = Error; + return -1; + } + disposePrevious(image); disposed = false; |