diff options
| author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2020-09-17 16:34:12 +0200 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2020-09-18 12:28:10 +0000 |
| commit | 550bac1f87f15deaaa7a5f2e47f3af159218bab2 (patch) | |
| tree | b94506c16f7d5794adf0dbe72f4a715f39358b42 /src | |
| parent | a1d85aef7132084800ca7c62ae6b5631093103d6 (diff) | |
xpm handler: fix read error caused by off-by-one in overflow check
The recently introduced overflow check for 8 bit images was too
aggressive, causing the last pixel on each line to be rejected.
As a driveby, add the same (fixed) overflow check also for 32bit
images.
Fixes: QTBUG-86691
Change-Id: I62e4d5884e314f1171cb5a3e2c48657ce7259676
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
(cherry picked from commit 6f2c7469f86785e6ba81fe0280210ef7275099de)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/gui/image/qxpmhandler.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/gui/image/qxpmhandler.cpp b/src/gui/image/qxpmhandler.cpp index 835e5e0152..8acc80776c 100644 --- a/src/gui/image/qxpmhandler.cpp +++ b/src/gui/image/qxpmhandler.cpp @@ -974,7 +974,7 @@ static bool read_xpm_body( } else { char b[16]; b[cpp] = '\0'; - for (x=0; x<w && d+cpp<end; x++) { + for (x = 0; x < w && d + cpp <= end; x++) { memcpy(b, (char *)d, cpp); *p++ = (uchar)colorMap[xpmHash(b)]; d += cpp; @@ -992,7 +992,7 @@ static bool read_xpm_body( int x; char b[16]; b[cpp] = '\0'; - for (x=0; x<w && d<end; x++) { + for (x = 0; x < w && d + cpp <= end; x++) { memcpy(b, (char *)d, cpp); *p++ = (QRgb)colorMap[xpmHash(b)]; d += cpp; |