From c4d8734c504cf0f313245befa34501e7314b4cd1 Mon Sep 17 00:00:00 2001 From: Lars Knoll Date: Tue, 25 Mar 2014 15:04:22 +0100 Subject: Avoid out of bounds memory reads when scaling images The calculation of the width/height required for the scaling algorithm was prone to floating point rounding issues, where the lower value got rounded down, the higher one rounded up. This could lead to a situation where we iterated over one more line/pixel in the line than we have in the source image. Correct this by passing the dimension of the source image into the function and bounds checking the values before iterating. Task-number: QTBUG-35927 Change-Id: If44b2235a479224660d508a0504fec40d724763a Reviewed-by: Laszlo Agocs --- src/gui/painting/qblendfunctions_p.h | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) (limited to 'src/gui/painting/qblendfunctions_p.h') diff --git a/src/gui/painting/qblendfunctions_p.h b/src/gui/painting/qblendfunctions_p.h index 97b89c8313..98e9e10bd8 100644 --- a/src/gui/painting/qblendfunctions_p.h +++ b/src/gui/painting/qblendfunctions_p.h @@ -60,7 +60,7 @@ QT_BEGIN_NAMESPACE template void qt_scale_image_16bit(uchar *destPixels, int dbpl, - const uchar *srcPixels, int sbpl, + const uchar *srcPixels, int sbpl, int srch, const QRectF &targetRect, const QRectF &srcRect, const QRect &clip, @@ -136,6 +136,15 @@ void qt_scale_image_16bit(uchar *destPixels, int dbpl, quint16 *dst = ((quint16 *) (destPixels + ty1 * dbpl)) + tx1; + // this bounds check here is required as floating point rounding above might in some cases lead to + // w/h values that are one pixel too large, falling outside of the valid image area. + int yend = (srcy + iy * (h - 1)) >> 16; + if (yend < 0 || yend >= srch) + --h; + int xend = (basex + ix * (w - 1)) >> 16; + if (xend < 0 || xend >= (int)(sbpl/sizeof(quint32))) + --w; + while (h--) { const SRC *src = (const SRC *) (srcPixels + (srcy >> 16) * sbpl); int srcx = basex; @@ -161,7 +170,7 @@ void qt_scale_image_16bit(uchar *destPixels, int dbpl, } template void qt_scale_image_32bit(uchar *destPixels, int dbpl, - const uchar *srcPixels, int sbpl, + const uchar *srcPixels, int sbpl, int srch, const QRectF &targetRect, const QRectF &srcRect, const QRect &clip, @@ -215,6 +224,8 @@ template void qt_scale_image_32bit(uchar *destPixels, int dbpl, int h = ty2 - ty1; int w = tx2 - tx1; + if (!w || !h) + return; quint32 basex; quint32 srcy; @@ -236,6 +247,15 @@ template void qt_scale_image_32bit(uchar *destPixels, int dbpl, quint32 *dst = ((quint32 *) (destPixels + ty1 * dbpl)) + tx1; + // this bounds check here is required as floating point rounding above might in some cases lead to + // w/h values that are one pixel too large, falling outside of the valid image area. + int yend = (srcy + iy * (h - 1)) >> 16; + if (yend < 0 || yend >= srch) + --h; + int xend = (basex + ix * (w - 1)) >> 16; + if (xend < 0 || xend >= (int)(sbpl/sizeof(quint32))) + --w; + while (h--) { const uint *src = (const quint32 *) (srcPixels + (srcy >> 16) * sbpl); int srcx = basex; -- cgit v1.2.3