path: root/src
diff options
authorLars Knoll <>2014-04-24 15:33:27 +0200
committerThe Qt Project <>2014-04-25 01:43:21 +0200
commiteb1325047f2697d24e93ebaf924900affc876bc1 (patch)
tree84311c797239b2c590f49d7cc3c17b653ef0d7b9 /src
parente57b521d950575a96d54e6944ab153a9505e51f7 (diff)
Don't crash on broken GIF images
Broken GIF images could set invalid width and height values inside the image, leading to Qt creating a null QImage for it. In that case we need to abort decoding the image and return an error. Initial patch by Rich Moore. Task-number: QTBUG-38367 Change-Id: Id82a4036f478bd6e49c402d6598f57e7e5bb5e1e Security-advisory: CVE-2014-0190 Reviewed-by: Richard J. Moore <>
Diffstat (limited to 'src')
1 files changed, 7 insertions, 0 deletions
diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
index eeb62af4e5..19b838240f 100644
--- a/src/gui/image/qgifhandler.cpp
+++ b/src/gui/image/qgifhandler.cpp
@@ -359,6 +359,13 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
memset(bits, 0, image->byteCount());
+ // Check if the previous attempt to create the image failed. If it
+ // did then the image is broken and we should give up.
+ if (image->isNull()) {
+ state = Error;
+ return -1;
+ }
disposed = false;