From 2841e2b61e32f26900bde987d469c8b97ea31999 Mon Sep 17 00:00:00 2001 From: Eirik Aavitsland Date: Fri, 3 Aug 2018 13:25:15 +0200 Subject: Check for QImage allocation failure in qgifhandler Since image files easily can be (or corrupt files claim to be) huge, it is worth checking for out of memory situations. Change-Id: I635a3ec6852288079fdec4e14cf7e776fe59e9e0 Reviewed-by: Lars Knoll --- src/plugins/imageformats/gif/qgifhandler.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/plugins/imageformats/gif/qgifhandler.cpp') diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp index e0f7f44701..ebe5964664 100644 --- a/src/plugins/imageformats/gif/qgifhandler.cpp +++ b/src/plugins/imageformats/gif/qgifhandler.cpp @@ -354,7 +354,8 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, (*image) = QImage(swidth, sheight, format); bpl = image->bytesPerLine(); bits = image->bits(); - memset(bits, 0, image->sizeInBytes()); + if (bits) + memset(bits, 0, image->sizeInBytes()); } // Check if the previous attempt to create the image failed. If it @@ -415,6 +416,10 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, backingstore = QImage(qMax(backingstore.width(), w), qMax(backingstore.height(), h), QImage::Format_RGB32); + if (backingstore.isNull()) { + state = Error; + return -1; + } memset(backingstore.bits(), 0, backingstore.sizeInBytes()); } const int dest_bpl = backingstore.bytesPerLine(); -- cgit v1.2.3