From 14f1ec186f87ce50037044ccb079463676518ec5 Mon Sep 17 00:00:00 2001 From: Allan Sandfeld Jensen Date: Wed, 13 Feb 2019 11:31:14 +0100 Subject: Make bytes-per-line safe for int overflow Goes through the Qt code and make sure bytes-per-line calculations are safe when they are too big for 32bit integers. Change-Id: I88b2d74b3da82e91407d316aa932a4a37587c0cf Reviewed-by: Lars Knoll --- src/gui/image/qbmphandler.cpp | 8 ++++-- src/gui/image/qimage.cpp | 30 ++++++++++++++-------- src/gui/image/qimage.h | 5 ++++ src/gui/image/qimage_p.h | 2 +- src/gui/image/qpixmap_win.cpp | 2 +- src/gui/image/qplatformpixmap.cpp | 4 +-- src/gui/image/qplatformpixmap.h | 2 +- src/gui/image/qpnghandler.cpp | 4 +-- src/gui/image/qppmhandler.cpp | 18 ++++++------- src/gui/kernel/qplatformcursor.cpp | 2 +- src/gui/painting/qbackingstore.cpp | 2 +- src/gui/painting/qdrawhelper.cpp | 2 +- src/gui/painting/qtextureglyphcache.cpp | 4 +-- src/gui/text/qfontengine.cpp | 4 +-- .../qplatformbackingstoreopenglsupport.cpp | 2 +- src/plugins/imageformats/gif/qgifhandler.cpp | 4 +-- src/plugins/imageformats/ico/qicohandler.cpp | 6 ++--- src/plugins/platforms/cocoa/qpaintengine_mac.mm | 2 +- src/plugins/platforms/vnc/qvnc.cpp | 2 +- src/plugins/platforms/windows/qwindowsmime.cpp | 9 ++++--- .../xcb/nativepainting/qpaintengine_x11.cpp | 2 +- .../platforms/xcb/nativepainting/qpixmap_x11.cpp | 8 +++--- src/plugins/platforms/xcb/qxcbbackingstore.cpp | 4 +-- src/plugins/platforms/xcb/qxcbimage.cpp | 2 +- src/plugins/styles/mac/qmacstyle_mac.mm | 4 +-- src/widgets/effects/qpixmapfilter.cpp | 18 ++++++------- src/widgets/styles/qstyleanimation.cpp | 2 +- src/widgets/widgets/qeffects.cpp | 2 +- .../gui/image/qimagewriter/tst_qimagewriter.cpp | 4 +-- .../widgets/widgets/qtextedit/tst_qtextedit.cpp | 2 +- tests/baselineserver/shared/baselineprotocol.cpp | 4 +-- 31 files changed, 93 insertions(+), 73 deletions(-) diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp index 32b6131309..d447faaceb 100644 --- a/src/gui/image/qbmphandler.cpp +++ b/src/gui/image/qbmphandler.cpp @@ -777,9 +777,9 @@ bool QBmpHandler::write(const QImage &img) } int nbits; - int bpl_bmp; + qsizetype bpl_bmp; // Calculate a minimum bytes-per-line instead of using whatever value this QImage is using internally. - int bpl = ((image.width() * image.depth() + 31) >> 5) << 2; + qsizetype bpl = ((image.width() * image.depth() + 31) >> 5) << 2; if (image.depth() == 8 && image.colorCount() <= 16) { bpl_bmp = (((bpl+1)/2+3)/4)*4; @@ -791,6 +791,8 @@ bool QBmpHandler::write(const QImage &img) bpl_bmp = bpl; nbits = image.depth(); } + if (qsizetype(int(bpl_bmp)) != bpl_bmp) + return false; if (m_format == DibFormat) { QDataStream dibStream(device()); @@ -813,6 +815,8 @@ bool QBmpHandler::write(const QImage &img) bf.bfReserved2 = 0; bf.bfOffBits = BMP_FILEHDR_SIZE + BMP_WIN + image.colorCount() * 4; bf.bfSize = bf.bfOffBits + bpl_bmp*image.height(); + if (qsizetype(bf.bfSize) != bf.bfOffBits + bpl_bmp*image.height()) + return false; s << bf; // write image diff --git a/src/gui/image/qimage.cpp b/src/gui/image/qimage.cpp index 1319d9dffc..684051786d 100644 --- a/src/gui/image/qimage.cpp +++ b/src/gui/image/qimage.cpp @@ -781,7 +781,7 @@ QImage::QImage(const QSize &size, Format format) -QImageData *QImageData::create(uchar *data, int width, int height, int bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction, void *cleanupInfo) +QImageData *QImageData::create(uchar *data, int width, int height, qsizetype bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction, void *cleanupInfo) { if (width <= 0 || height <= 0 || !data || format == QImage::Format_Invalid) return nullptr; @@ -793,7 +793,7 @@ QImageData *QImageData::create(uchar *data, int width, int height, int bpl, QIm if (bpl > 0) { // can't overflow, because has calculateImageParameters already done this multiplication - const int min_bytes_per_line = (width * depth + 7)/8; + const qsizetype min_bytes_per_line = (qsizetype(width) * depth + 7)/8; if (bpl < min_bytes_per_line) return nullptr; @@ -894,13 +894,17 @@ QImage::QImage(const uchar* data, int width, int height, Format format, QImageCl initially empty and must be sufficiently expanded with setColorCount() or setColorTable() before the image is used. */ + +#if QT_VERSION >= QT_VERSION_CHECK(6,0,0) +QImage::QImage(uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo) +#else QImage::QImage(uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo) +#endif :QPaintDevice() { d = QImageData::create(data, width, height, bytesPerLine, format, false, cleanupFunction, cleanupInfo); } - /*! Constructs an image with the given \a width, \a height and \a format, that uses an existing memory buffer, \a data. The \a width @@ -926,7 +930,11 @@ QImage::QImage(uchar *data, int width, int height, int bytesPerLine, Format form data being changed. */ +#if QT_VERSION >= QT_VERSION_CHECK(6,0,0) +QImage::QImage(const uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo) +#else QImage::QImage(const uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction, void *cleanupInfo) +#endif :QPaintDevice() { d = QImageData::create(const_cast(data), width, height, bytesPerLine, format, true, cleanupFunction, cleanupInfo); @@ -1165,7 +1173,7 @@ QImage QImage::copy(const QRect& r) const // Qt for Embedded Linux can create images with non-default bpl // make sure we don't crash. if (image.d->nbytes != d->nbytes) { - int bpl = qMin(bytesPerLine(), image.bytesPerLine()); + qsizetype bpl = qMin(bytesPerLine(), image.bytesPerLine()); for (int i = 0; i < height(); i++) memcpy(image.scanLine(i), scanLine(i), bpl); } else @@ -1224,7 +1232,7 @@ QImage QImage::copy(const QRect& r) const if (byteAligned) { const uchar *src = d->data + ((x * d->depth) >> 3) + y * d->bytes_per_line; uchar *dest = image.d->data + ((dx * d->depth) >> 3) + dy * image.d->bytes_per_line; - const int bytes_to_copy = (pixels_to_copy * d->depth) >> 3; + const qsizetype bytes_to_copy = (qsizetype(pixels_to_copy) * d->depth) >> 3; for (int i = 0; i < lines_to_copy; ++i) { memcpy(dest, src, bytes_to_copy); src += d->bytes_per_line; @@ -1890,11 +1898,11 @@ void QImage::invertPixels(InvertMode mode) if (depth() < 32) { // This assumes no alpha-channel as the only formats with non-premultipled alpha are 32bit. - int bpl = (d->width * d->depth + 7) / 8; + qsizetype bpl = (qsizetype(d->width) * d->depth + 7) / 8; int pad = d->bytes_per_line - bpl; uchar *sl = d->data; for (int y=0; yheight; ++y) { - for (int x=0; xformat; @@ -4767,7 +4775,7 @@ QImage QImage::transformed(const QTransform &matrix, Qt::TransformationMode mode // create target image (some of the code is from QImage::copy()) int type = format() == Format_Mono ? QT_XFORM_TYPE_MSBFIRST : QT_XFORM_TYPE_LSBFIRST; - int dbpl = dImage.bytesPerLine(); + qsizetype dbpl = dImage.bytesPerLine(); qt_xForm_helper(mat, 0, type, bpp, dImage.bits(), dbpl, 0, hd, sptr, sbpl, ws, hs); } copyMetadata(dImage.d, d); diff --git a/src/gui/image/qimage.h b/src/gui/image/qimage.h index 35dc41be2d..a9c0fbbe3e 100644 --- a/src/gui/image/qimage.h +++ b/src/gui/image/qimage.h @@ -117,8 +117,13 @@ public: QImage(int width, int height, Format format); QImage(uchar *data, int width, int height, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); QImage(const uchar *data, int width, int height, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); +#if QT_VERSION >= QT_VERSION_CHECK(6,0,0) + QImage(uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); + QImage(const uchar *data, int width, int height, qsizetype bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); +#else QImage(uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); QImage(const uchar *data, int width, int height, int bytesPerLine, Format format, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); +#endif #ifndef QT_NO_IMAGEFORMAT_XPM explicit QImage(const char * const xpm[]); diff --git a/src/gui/image/qimage_p.h b/src/gui/image/qimage_p.h index 9277472c3c..6f6f626858 100644 --- a/src/gui/image/qimage_p.h +++ b/src/gui/image/qimage_p.h @@ -67,7 +67,7 @@ struct Q_GUI_EXPORT QImageData { // internal image data QImageData(); ~QImageData(); static QImageData *create(const QSize &size, QImage::Format format); - static QImageData *create(uchar *data, int w, int h, int bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); + static QImageData *create(uchar *data, int w, int h, qsizetype bpl, QImage::Format format, bool readOnly, QImageCleanupFunction cleanupFunction = nullptr, void *cleanupInfo = nullptr); QAtomicInt ref; diff --git a/src/gui/image/qpixmap_win.cpp b/src/gui/image/qpixmap_win.cpp index 8aad77b991..be6cd0c5fc 100644 --- a/src/gui/image/qpixmap_win.cpp +++ b/src/gui/image/qpixmap_win.cpp @@ -121,7 +121,7 @@ static inline void copyImageDataCreateAlpha(const uchar *data, QImage *target) const uint mask = target->format() == QImage::Format_RGB32 ? 0xff000000 : 0; const int height = target->height(); const int width = target->width(); - const int bytesPerLine = width * int(sizeof(QRgb)); + const qsizetype bytesPerLine = width * sizeof(QRgb); for (int y = 0; y < height; ++y) { QRgb *dest = reinterpret_cast(target->scanLine(y)); const QRgb *src = reinterpret_cast(data + y * bytesPerLine); diff --git a/src/gui/image/qplatformpixmap.cpp b/src/gui/image/qplatformpixmap.cpp index 493f55514e..ea4243ba07 100644 --- a/src/gui/image/qplatformpixmap.cpp +++ b/src/gui/image/qplatformpixmap.cpp @@ -183,7 +183,7 @@ QBitmap QPlatformPixmap::mask() const mask.setColor(0, QColor(Qt::color0).rgba()); mask.setColor(1, QColor(Qt::color1).rgba()); - const int bpl = mask.bytesPerLine(); + const qsizetype bpl = mask.bytesPerLine(); for (int y = 0; y < h; ++y) { const QRgb *src = reinterpret_cast(image.scanLine(y)); @@ -216,7 +216,7 @@ void QPlatformPixmap::setMask(const QBitmap &mask) for (int y = 0; y < h; ++y) { const uchar *mscan = imageMask.scanLine(y); uchar *tscan = image.scanLine(y); - int bytesPerLine = image.bytesPerLine(); + qsizetype bytesPerLine = image.bytesPerLine(); for (int i = 0; i < bytesPerLine; ++i) tscan[i] &= mscan[i]; } diff --git a/src/gui/image/qplatformpixmap.h b/src/gui/image/qplatformpixmap.h index 7635ac2949..9c7f5e5edf 100644 --- a/src/gui/image/qplatformpixmap.h +++ b/src/gui/image/qplatformpixmap.h @@ -163,7 +163,7 @@ private: # define QT_XFORM_TYPE_MSBFIRST 0 # define QT_XFORM_TYPE_LSBFIRST 1 -Q_GUI_EXPORT bool qt_xForm_helper(const QTransform&, int, int, int, uchar*, int, int, int, const uchar*, int, int, int); +Q_GUI_EXPORT bool qt_xForm_helper(const QTransform&, int, int, int, uchar*, qsizetype, int, int, const uchar*, qsizetype, int, int); QT_END_NAMESPACE diff --git a/src/gui/image/qpnghandler.cpp b/src/gui/image/qpnghandler.cpp index 8435e5a0fe..e6a3604ad4 100644 --- a/src/gui/image/qpnghandler.cpp +++ b/src/gui/image/qpnghandler.cpp @@ -455,7 +455,7 @@ static void read_image_scaled(QImage *outImage, png_structp png_ptr, png_infop i png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type, nullptr, nullptr, nullptr); png_get_oFFs(png_ptr, info_ptr, &offset_x, &offset_y, &unit_type); uchar *data = outImage->bits(); - int bpl = outImage->bytesPerLine(); + qsizetype bpl = outImage->bytesPerLine(); if (scaledSize.isEmpty() || !width || !height) return; @@ -709,7 +709,7 @@ bool QPngHandlerPrivate::readPngImage(QImage *outImage) png_get_IHDR(png_ptr, info_ptr, &width, &height, &bit_depth, &color_type, nullptr, nullptr, nullptr); png_get_oFFs(png_ptr, info_ptr, &offset_x, &offset_y, &unit_type); uchar *data = outImage->bits(); - int bpl = outImage->bytesPerLine(); + qsizetype bpl = outImage->bytesPerLine(); amp.row_pointers = new png_bytep[height]; for (uint y = 0; y < height; y++) diff --git a/src/gui/image/qppmhandler.cpp b/src/gui/image/qppmhandler.cpp index 13ee2eadd2..195e58d283 100644 --- a/src/gui/image/qppmhandler.cpp +++ b/src/gui/image/qppmhandler.cpp @@ -135,7 +135,7 @@ static inline QRgb scale_pbm_color(quint16 mx, quint16 rv, quint16 gv, quint16 b static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, QImage *outImage) { int nbits, y; - int pbm_bpl; + qsizetype pbm_bpl; bool raw; QImage::Format format; @@ -166,7 +166,7 @@ static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, Q return false; } - pbm_bpl = (nbits*w+7)/8; // bytes per scanline in PBM + pbm_bpl = (qsizetype(w) * nbits + 7) / 8; // bytes per scanline in PBM if (raw) { // read raw data if (nbits == 32) { // type 6 @@ -225,14 +225,14 @@ static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, Q if (device->read((char *)p, pbm_bpl) != pbm_bpl) return false; if (nbits == 8 && mcc < 255) { - for (int i = 0; i < pbm_bpl; i++) + for (qsizetype i = 0; i < pbm_bpl; i++) p[i] = (p[i] * 255) / mcc; } } } } else { // read ascii data uchar *p; - int n; + qsizetype n; char buf; for (y = 0; (y < h) && (device->peek(&buf, 1) == 1); y++) { p = outImage->scanLine(y); @@ -367,7 +367,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy str.append("255\n"); if (out->write(str, str.length()) != str.length()) return false; - uint bpl = w * (gray ? 1 : 3); + qsizetype bpl = qsizetype(w) * (gray ? 1 : 3); uchar *buf = new uchar[bpl]; if (image.format() == QImage::Format_Indexed8) { QVector color = image.colorTable(); @@ -388,7 +388,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy *p++ = qBlue(rgb); } } - if (bpl != (uint)out->write((char*)buf, bpl)) + if (bpl != (qsizetype)out->write((char*)buf, bpl)) return false; } } else { @@ -407,7 +407,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy *p++ = color; } } - if (bpl != (uint)out->write((char*)buf, bpl)) + if (bpl != (qsizetype)out->write((char*)buf, bpl)) return false; } } @@ -420,7 +420,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy str.append("255\n"); if (out->write(str, str.length()) != str.length()) return false; - uint bpl = w * 3; + qsizetype bpl = qsizetype(w) * 3; uchar *buf = new uchar[bpl]; for (uint y=0; y(image.constScanLine(y)); @@ -432,7 +432,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QBy *p++ = qGreen(rgb); *p++ = qBlue(rgb); } - if (bpl != (uint)out->write((char*)buf, bpl)) + if (bpl != (qsizetype)out->write((char*)buf, bpl)) return false; } delete [] buf; diff --git a/src/gui/kernel/qplatformcursor.cpp b/src/gui/kernel/qplatformcursor.cpp index 5a438a54a2..1330b5bf31 100644 --- a/src/gui/kernel/qplatformcursor.cpp +++ b/src/gui/kernel/qplatformcursor.cpp @@ -622,7 +622,7 @@ void QPlatformCursorImage::set(const uchar *data, const uchar *mask, int x = -1, w = 0; uchar *cursor_data = cursorImage.bits(); - int bpl = cursorImage.bytesPerLine(); + qsizetype bpl = cursorImage.bytesPerLine(); for (int i = 0; i < height; i++) { for (int j = 0; j < bytesPerLine; j++, data++, mask++) diff --git a/src/gui/painting/qbackingstore.cpp b/src/gui/painting/qbackingstore.cpp index 2147d9d61d..5bbc03db80 100644 --- a/src/gui/painting/qbackingstore.cpp +++ b/src/gui/painting/qbackingstore.cpp @@ -322,7 +322,7 @@ void Q_GUI_EXPORT qt_scrollRectInImage(QImage &img, const QRect &rect, const QPo // make sure we don't detach uchar *mem = const_cast(const_cast(img).bits()); - int lineskip = img.bytesPerLine(); + qsizetype lineskip = img.bytesPerLine(); int depth = img.depth() >> 3; const QRect imageRect(0, 0, img.width(), img.height()); diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp index 2d4045fe29..e4e8305620 100644 --- a/src/gui/painting/qdrawhelper.cpp +++ b/src/gui/painting/qdrawhelper.cpp @@ -2906,7 +2906,7 @@ static void QT_FASTCALL fetchTransformedBilinearARGB32PM_fast_rotate_helper(uint int32x4_t v_fdy = vdupq_n_s32(fdy * 4); const uchar *textureData = image.imageData; - const int bytesPerLine = image.bytesPerLine; + const qsizetype bytesPerLine = image.bytesPerLine; int32x4_t v_fx = vmovq_n_s32(fx); int32x4_t v_fy = vmovq_n_s32(fy); diff --git a/src/gui/painting/qtextureglyphcache.cpp b/src/gui/painting/qtextureglyphcache.cpp index 91214f27ca..e906397520 100644 --- a/src/gui/painting/qtextureglyphcache.cpp +++ b/src/gui/painting/qtextureglyphcache.cpp @@ -350,7 +350,7 @@ void QImageTextureGlyphCache::fillTexture(const Coord &c, glyph_t g, QFixed subP int mw = qMin(mask.width(), c.w); int mh = qMin(mask.height(), c.h); uchar *d = m_image.bits(); - int dbpl = m_image.bytesPerLine(); + qsizetype dbpl = m_image.bytesPerLine(); for (int y = 0; y < c.h; ++y) { uchar *dest = d + (c.y + y) *dbpl + c.x/8; @@ -372,7 +372,7 @@ void QImageTextureGlyphCache::fillTexture(const Coord &c, glyph_t g, QFixed subP int mw = qMin(mask.width(), c.w); int mh = qMin(mask.height(), c.h); uchar *d = m_image.bits(); - int dbpl = m_image.bytesPerLine(); + qsizetype dbpl = m_image.bytesPerLine(); if (mask.depth() == 1) { for (int y = 0; y < c.h; ++y) { diff --git a/src/gui/text/qfontengine.cpp b/src/gui/text/qfontengine.cpp index 3ca9e9bbde..38814937f6 100644 --- a/src/gui/text/qfontengine.cpp +++ b/src/gui/text/qfontengine.cpp @@ -804,14 +804,14 @@ void QFontEngine::addBitmapFontToPath(qreal x, qreal y, const QGlyphLayout &glyp const int w = alphaMask.width(); const int h = alphaMask.height(); - const int srcBpl = alphaMask.bytesPerLine(); + const qsizetype srcBpl = alphaMask.bytesPerLine(); QImage bitmap; if (alphaMask.depth() == 1) { bitmap = alphaMask; } else { bitmap = QImage(w, h, QImage::Format_Mono); const uchar *imageData = alphaMask.bits(); - const int destBpl = bitmap.bytesPerLine(); + const qsizetype destBpl = bitmap.bytesPerLine(); uchar *bitmapData = bitmap.bits(); for (int yi = 0; yi < h; ++yi) { diff --git a/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp b/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp index ca50910114..511d85a400 100644 --- a/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp +++ b/src/platformsupport/platformcompositor/qplatformbackingstoreopenglsupport.cpp @@ -385,7 +385,7 @@ GLuint QPlatformBackingStoreOpenGLSupport::toTexture(const QRegion &dirtyRegion, // The image provided by the backingstore may have a stride larger than width * 4, for // instance on platforms that manually implement client-side decorations. static const int bytesPerPixel = 4; - const int strideInPixels = image.bytesPerLine() / bytesPerPixel; + const qsizetype strideInPixels = image.bytesPerLine() / bytesPerPixel; const bool hasUnpackRowLength = !ctx->isOpenGLES() || ctx->format().majorVersion() >= 3; QOpenGLFunctions *funcs = ctx->functions(); diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp index c92cc3ea61..a672e92006 100644 --- a/src/plugins/imageformats/gif/qgifhandler.cpp +++ b/src/plugins/imageformats/gif/qgifhandler.cpp @@ -246,7 +246,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, } image->detach(); - int bpl = image->bytesPerLine(); + qsizetype bpl = image->bytesPerLine(); unsigned char *bits = image->bits(); #define LM(l, m) (((m)<<8)|l) @@ -422,7 +422,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, } memset(backingstore.bits(), 0, backingstore.sizeInBytes()); } - const int dest_bpl = backingstore.bytesPerLine(); + const qsizetype dest_bpl = backingstore.bytesPerLine(); unsigned char *dest_data = backingstore.bits(); for (int ln=0; ln= 0) { if (iod->read((char*)image.scanLine(h),bpl) != bpl) { @@ -405,7 +405,7 @@ void ICOReader::read8BitBMP(QImage & image) if (iod) { int h = icoAttrib.h; - int bpl = image.bytesPerLine(); + qsizetype bpl = image.bytesPerLine(); while (--h >= 0) { if (iod->read((char *)image.scanLine(h), bpl) != bpl) { @@ -425,7 +425,7 @@ void ICOReader::read16_24_32BMP(QImage & image) QRgb *p; QRgb *end; uchar *buf = new uchar[image.bytesPerLine()]; - int bpl = ((icoAttrib.w*icoAttrib.nbits+31)/32)*4; + qsizetype bpl = ((qsizetype(icoAttrib.w)*icoAttrib.nbits+31)/32)*4; uchar *b; while (--h >= 0) { diff --git a/src/plugins/platforms/cocoa/qpaintengine_mac.mm b/src/plugins/platforms/cocoa/qpaintengine_mac.mm index 00b2267f0d..cadb76d2e4 100644 --- a/src/plugins/platforms/cocoa/qpaintengine_mac.mm +++ b/src/plugins/platforms/cocoa/qpaintengine_mac.mm @@ -90,7 +90,7 @@ CGImageRef qt_mac_create_imagemask(const QPixmap &pixmap, const QRectF &sr) image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied); const int sx = qRound(sr.x()), sy = qRound(sr.y()), sw = qRound(sr.width()), sh = qRound(sr.height()); - const int sbpr = image.bytesPerLine(); + const qsizetype sbpr = image.bytesPerLine(); const uint nbytes = sw * sh; // alpha is always 255 for bitmaps, ignore it in this case. const quint32 mask = pixmap.depth() == 1 ? 0x00ffffff : 0xffffffff; diff --git a/src/plugins/platforms/vnc/qvnc.cpp b/src/plugins/platforms/vnc/qvnc.cpp index 8390fa19cd..aea8d26983 100644 --- a/src/plugins/platforms/vnc/qvnc.cpp +++ b/src/plugins/platforms/vnc/qvnc.cpp @@ -502,7 +502,7 @@ void QRfbRawEncoder::write() const quint32 encoding = htonl(0); // raw encoding socket->write((char *)&encoding, sizeof(encoding)); - int linestep = screenImage.bytesPerLine(); + qsizetype linestep = screenImage.bytesPerLine(); const uchar *screendata = screenImage.scanLine(rect.y) + rect.x * screenImage.depth() / 8; diff --git a/src/plugins/platforms/windows/qwindowsmime.cpp b/src/plugins/platforms/windows/qwindowsmime.cpp index fe9e1fe31f..9bc79a10f9 100644 --- a/src/plugins/platforms/windows/qwindowsmime.cpp +++ b/src/plugins/platforms/windows/qwindowsmime.cpp @@ -149,7 +149,10 @@ static bool qt_write_dibv5(QDataStream &s, QImage image) return false; //depth will be always 32 - int bpl_bmp = image.width()*4; + qsizetype bpl_bmp = qsizetype(image.width()) * 4; + qsizetype size = bpl_bmp * image.height(); + if (qsizetype(DWORD(size)) != size) + return false; BMP_BITMAPV5HEADER bi; ZeroMemory(&bi, sizeof(bi)); @@ -261,11 +264,11 @@ static bool qt_read_dibv5(QDataStream &s, QImage &image) const int blue_shift = calc_shift(blue_mask); const int alpha_shift = alpha_mask ? calc_shift(alpha_mask) : 0u; - const int bpl = image.bytesPerLine(); + const qsizetype bpl = image.bytesPerLine(); uchar *data = image.bits(); auto *buf24 = new uchar[bpl]; - const int bpl24 = ((w * nbits + 31) / 32) * 4; + const qsizetype bpl24 = ((qsizetype(w) * nbits + 31) / 32) * 4; while (--h >= 0) { QRgb *p = reinterpret_cast(data + h * bpl); diff --git a/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp b/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp index 82b6d60bcd..7bf2b38d7d 100644 --- a/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp +++ b/src/plugins/platforms/xcb/nativepainting/qpaintengine_x11.cpp @@ -2016,7 +2016,7 @@ Q_GUI_EXPORT void qt_x11_drawImage(const QRect &rect, const QPoint &pos, const Q || (image_byte_order == LSBFirst && bgr_layout)) { im = image.copy(rect); - const int iw = im.bytesPerLine() / 4; + const qsizetype iw = im.bytesPerLine() / 4; uint *data = (uint *)im.bits(); for (int i=0; i < h; i++) { uint *p = data; diff --git a/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp b/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp index f86bedbdcd..467e93e64f 100644 --- a/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp +++ b/src/plugins/platforms/xcb/nativepainting/qpixmap_x11.cpp @@ -1747,7 +1747,7 @@ XID QX11PlatformPixmap::createBitmapFromImage(const QImage &image) int w = img.width(); int h = img.height(); int bpl = (w + 7) / 8; - int ibpl = img.bytesPerLine(); + qsizetype ibpl = img.bytesPerLine(); if (bpl != ibpl) { tmp_bits = new uchar[bpl*h]; bits = (char *)tmp_bits; @@ -2017,7 +2017,7 @@ QImage QX11PlatformPixmap::toImage(const QXImageWrapper &xiWrapper, const QRect } } else if (xi->bits_per_pixel == d) { // compatible depth char *xidata = xi->data; // copy each scanline - int bpl = qMin(int(image.bytesPerLine()),xi->bytes_per_line); + qsizetype bpl = qMin(image.bytesPerLine(),xi->bytes_per_line); for (int y=0; yheight; y++) { memcpy(image.scanLine(y), xidata, bpl); xidata += xi->bytes_per_line; @@ -2038,10 +2038,10 @@ QImage QX11PlatformPixmap::toImage(const QXImageWrapper &xiWrapper, const QRect uchar *end; uchar use[256]; // pixel-in-use table uchar pix[256]; // pixel translation table - int ncols, bpl; + int ncols; memset(use, 0, 256); memset(pix, 0, 256); - bpl = image.bytesPerLine(); + qsizetype bpl = image.bytesPerLine(); if (x11_mask) { // which pixels are used? for (int i = 0; i < xi->height; i++) { diff --git a/src/plugins/platforms/xcb/qxcbbackingstore.cpp b/src/plugins/platforms/xcb/qxcbbackingstore.cpp index 8f55bc2e96..7330c3c9a3 100644 --- a/src/plugins/platforms/xcb/qxcbbackingstore.cpp +++ b/src/plugins/platforms/xcb/qxcbbackingstore.cpp @@ -537,7 +537,7 @@ void QXcbBackingStoreImage::ensureGC(xcb_drawable_t dst) static inline void copy_unswapped(char *dst, int dstBytesPerLine, const QImage &img, const QRect &rect) { const uchar *srcData = img.constBits(); - const int srcBytesPerLine = img.bytesPerLine(); + const qsizetype srcBytesPerLine = img.bytesPerLine(); const int leftOffset = rect.left() * img.depth() >> 3; const int bottom = rect.bottom() + 1; @@ -553,7 +553,7 @@ template static inline void copy_swapped(char *dst, const int dstStride, const QImage &img, const QRect &rect) { const uchar *srcData = img.constBits(); - const int srcBytesPerLine = img.bytesPerLine(); + const qsizetype srcBytesPerLine = img.bytesPerLine(); const int left = rect.left(); const int width = rect.width(); diff --git a/src/plugins/platforms/xcb/qxcbimage.cpp b/src/plugins/platforms/xcb/qxcbimage.cpp index b0e610dd51..5b5c37fac4 100644 --- a/src/plugins/platforms/xcb/qxcbimage.cpp +++ b/src/plugins/platforms/xcb/qxcbimage.cpp @@ -212,7 +212,7 @@ xcb_pixmap_t qt_xcb_XPixmapFromBitmap(QXcbScreen *screen, const QImage &image) } const int width = bitmap.width(); const int height = bitmap.height(); - const int bytesPerLine = bitmap.bytesPerLine(); + const qsizetype bytesPerLine = bitmap.bytesPerLine(); int destLineSize = width / 8; if (width % 8) ++destLineSize; diff --git a/src/plugins/styles/mac/qmacstyle_mac.mm b/src/plugins/styles/mac/qmacstyle_mac.mm index e2599e8c6b..d45ee1a694 100644 --- a/src/plugins/styles/mac/qmacstyle_mac.mm +++ b/src/plugins/styles/mac/qmacstyle_mac.mm @@ -2766,12 +2766,12 @@ int QMacStyle::styleHint(StyleHint sh, const QStyleOption *opt, const QWidget *w } const QRgb *sptr = (QRgb*)img.bits(), *srow; - const int sbpl = img.bytesPerLine(); + const qsizetype sbpl = img.bytesPerLine(); const int w = sbpl/4, h = img.height(); QImage img_mask(img.width(), img.height(), QImage::Format_ARGB32); QRgb *dptr = (QRgb*)img_mask.bits(), *drow; - const int dbpl = img_mask.bytesPerLine(); + const qsizetype dbpl = img_mask.bytesPerLine(); for (int y = 0; y < h; ++y) { srow = sptr+((y*sbpl)/4); diff --git a/src/widgets/effects/qpixmapfilter.cpp b/src/widgets/effects/qpixmapfilter.cpp index 1f899c2660..705871719f 100644 --- a/src/widgets/effects/qpixmapfilter.cpp +++ b/src/widgets/effects/qpixmapfilter.cpp @@ -784,11 +784,11 @@ Q_WIDGETS_EXPORT QImage qt_halfScaled(const QImage &source) dest.setDevicePixelRatio(source.devicePixelRatioF()); const uchar *src = reinterpret_cast(const_cast(srcImage).bits()); - int sx = srcImage.bytesPerLine(); - int sx2 = sx << 1; + qsizetype sx = srcImage.bytesPerLine(); + qsizetype sx2 = sx << 1; uchar *dst = reinterpret_cast(dest.bits()); - int dx = dest.bytesPerLine(); + qsizetype dx = dest.bytesPerLine(); int ww = dest.width(); int hh = dest.height(); @@ -806,11 +806,11 @@ Q_WIDGETS_EXPORT QImage qt_halfScaled(const QImage &source) dest.setDevicePixelRatio(source.devicePixelRatioF()); const uchar *src = reinterpret_cast(const_cast(srcImage).bits()); - int sx = srcImage.bytesPerLine(); - int sx2 = sx << 1; + qsizetype sx = srcImage.bytesPerLine(); + qsizetype sx2 = sx << 1; uchar *dst = reinterpret_cast(dest.bits()); - int dx = dest.bytesPerLine(); + qsizetype dx = dest.bytesPerLine(); int ww = dest.width(); int hh = dest.height(); @@ -843,11 +843,11 @@ Q_WIDGETS_EXPORT QImage qt_halfScaled(const QImage &source) dest.setDevicePixelRatio(source.devicePixelRatioF()); const quint32 *src = reinterpret_cast(const_cast(srcImage).bits()); - int sx = srcImage.bytesPerLine() >> 2; - int sx2 = sx << 1; + qsizetype sx = srcImage.bytesPerLine() >> 2; + qsizetype sx2 = sx << 1; quint32 *dst = reinterpret_cast(dest.bits()); - int dx = dest.bytesPerLine() >> 2; + qsizetype dx = dest.bytesPerLine() >> 2; int ww = dest.width(); int hh = dest.height(); diff --git a/src/widgets/styles/qstyleanimation.cpp b/src/widgets/styles/qstyleanimation.cpp index b9202eae69..1c1158ab10 100644 --- a/src/widgets/styles/qstyleanimation.cpp +++ b/src/widgets/styles/qstyleanimation.cpp @@ -266,7 +266,7 @@ static QImage blendedImage(const QImage &start, const QImage &end, float alpha) const int ia = 256 - a; const int sw = start.width(); const int sh = start.height(); - const int bpl = start.bytesPerLine(); + const qsizetype bpl = start.bytesPerLine(); switch (start.depth()) { case 32: { diff --git a/src/widgets/widgets/qeffects.cpp b/src/widgets/widgets/qeffects.cpp index ee4095cb36..5cb8bb3c50 100644 --- a/src/widgets/widgets/qeffects.cpp +++ b/src/widgets/widgets/qeffects.cpp @@ -305,7 +305,7 @@ void QAlphaWidget::alphaBlend() const int sw = frontImage.width(); const int sh = frontImage.height(); - const int bpl = frontImage.bytesPerLine(); + const qsizetype bpl = frontImage.bytesPerLine(); switch(frontImage.depth()) { case 32: { diff --git a/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp b/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp index aaa8475c74..247f6443c1 100644 --- a/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp +++ b/tests/auto/gui/image/qimagewriter/tst_qimagewriter.cpp @@ -94,8 +94,8 @@ private: static void initializePadding(QImage *image) { - int effectiveBytesPerLine = (image->width() * image->depth() + 7) / 8; - int paddingBytes = image->bytesPerLine() - effectiveBytesPerLine; + qsizetype effectiveBytesPerLine = (qsizetype(image->width()) * image->depth() + 7) / 8; + qsizetype paddingBytes = image->bytesPerLine() - effectiveBytesPerLine; if (paddingBytes == 0) return; for (int y = 0; y < image->height(); ++y) { diff --git a/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp b/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp index 485a0b0f93..bd287eb225 100644 --- a/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp +++ b/tests/auto/widgets/widgets/qtextedit/tst_qtextedit.cpp @@ -2136,7 +2136,7 @@ void tst_QTextEdit::compareWidgetAndImage(QTextEdit &widget, const QString &imag QCOMPARE(image.depth(), 32); QCOMPARE(original.depth(), image.depth()); - const int bytesPerLine = image.bytesPerLine(); + const qsizetype bytesPerLine = image.bytesPerLine(); const int width = image.width(); const int height = image.height(); diff --git a/tests/baselineserver/shared/baselineprotocol.cpp b/tests/baselineserver/shared/baselineprotocol.cpp index 9e5321cb1b..d11369f3d2 100644 --- a/tests/baselineserver/shared/baselineprotocol.cpp +++ b/tests/baselineserver/shared/baselineprotocol.cpp @@ -223,8 +223,8 @@ quint32 *pb); /* IN: more seed OUT: secondary hash value */ quint64 ImageItem::computeChecksum(const QImage &image) { QImage img(image); - const int bpl = img.bytesPerLine(); - const int padBytes = bpl - (img.width() * img.depth() / 8); + const qsizetype bpl = img.bytesPerLine(); + const int padBytes = bpl - (qsizetype(img.width()) * img.depth() / 8); if (padBytes) { uchar *p = img.bits() + bpl - padBytes; const int h = img.height(); -- cgit v1.2.3