From fa7a83953047fa79c27dc8e5bb9d42cb07fe2b7f Mon Sep 17 00:00:00 2001
From: Eirik Aavitsland <eirik.aavitsland@qt.io>
Date: Thu, 17 Sep 2020 16:34:12 +0200
Subject: xpm handler: fix read error caused by off-by-one in overflow check

The recently introduced overflow check for 8 bit images was too
aggressive, causing the last pixel on each line to be rejected.

As a driveby, add the same (fixed) overflow check also for 32bit
images.

Fixes: QTBUG-86691
Change-Id: I62e4d5884e314f1171cb5a3e2c48657ce7259676
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
(cherry picked from commit 6f2c7469f86785e6ba81fe0280210ef7275099de)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
---
 src/gui/image/qxpmhandler.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/gui/image/qxpmhandler.cpp b/src/gui/image/qxpmhandler.cpp
index 417dab7ce3..14823b457e 100644
--- a/src/gui/image/qxpmhandler.cpp
+++ b/src/gui/image/qxpmhandler.cpp
@@ -973,7 +973,7 @@ static bool read_xpm_body(
             } else {
                 char b[16];
                 b[cpp] = '\0';
-                for (x=0; x<w && d+cpp<end; x++) {
+                for (x = 0; x < w && d + cpp <= end; x++) {
                     memcpy(b, (char *)d, cpp);
                     *p++ = (uchar)colorMap[xpmHash(b)];
                     d += cpp;
@@ -991,7 +991,7 @@ static bool read_xpm_body(
             int x;
             char b[16];
             b[cpp] = '\0';
-            for (x=0; x<w && d<end; x++) {
+            for (x = 0; x < w && d + cpp <= end; x++) {
                 memcpy(b, (char *)d, cpp);
                 *p++ = (QRgb)colorMap[xpmHash(b)];
                 d += cpp;
-- 
cgit v1.2.3