From 8edf11d51059b2ecb42dbf45f037d88e5b2beab6 Mon Sep 17 00:00:00 2001
From: Eirik Aavitsland <eirik.aavitsland@qt.io>
Date: Thu, 4 Jun 2020 17:03:53 +0200
Subject: Gif decoder: Harden handling of corrupt files

Fix potential UB for corrupt files.

Pick-to: 5.15 5.12
Change-Id: If5d1b859a03b09e3479a6a7adaaf3432958126b4
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
---
 src/plugins/imageformats/gif/qgifhandler.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'src/plugins/imageformats/gif')

diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp
index f7dc8e481f..078d3d596d 100644
--- a/src/plugins/imageformats/gif/qgifhandler.cpp
+++ b/src/plugins/imageformats/gif/qgifhandler.cpp
@@ -53,8 +53,7 @@ QT_BEGIN_NAMESPACE
 #define Q_TRANSPARENT 0x00ffffff
 
 // avoid going through QImage::scanLine() which calls detach
-#define FAST_SCAN_LINE(bits, bpl, y) (bits + (y) * bpl)
-
+#define FAST_SCAN_LINE(bits, bpl, y) (bits + qptrdiff(y) * bpl)
 
 /*
   Incremental image decoder for GIF image format.
@@ -491,6 +490,10 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
             break;
           case ImageDataBlock:
             count++;
+            if (bitcount < 0 || bitcount > 31) {
+                state = Error;
+                return -1;
+            }
             accum|=(ch<<bitcount);
             bitcount+=8;
             while (bitcount>=code_size && state==ImageDataBlock) {
-- 
cgit v1.2.3