From 27fae7207fabc5bd5e34beab0cfeedfc8b8ede78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20L=C3=B6hning?= Date: Fri, 25 Feb 2022 20:26:59 +0100 Subject: png/ico decoder: Don't try reading beyond the file This fixes oss-fuzz issue 44955. Pick-to: 6.2 6.3 Change-Id: Ie74ae037630f83e64fd0678ff2eac579f35d02b8 Reviewed-by: Qt CI Bot Reviewed-by: Eirik Aavitsland --- src/plugins/imageformats/ico/qicohandler.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp index a3fe9d740c..e1811e861d 100644 --- a/src/plugins/imageformats/ico/qicohandler.cpp +++ b/src/plugins/imageformats/ico/qicohandler.cpp @@ -1,6 +1,6 @@ /**************************************************************************** ** -** Copyright (C) 2016 The Qt Company Ltd. +** Copyright (C) 2022 The Qt Company Ltd. ** Contact: https://www.qt.io/licensing/ ** ** This file is part of the plugins of the Qt Toolkit. @@ -466,7 +466,9 @@ QImage ICOReader::iconAt(int index) static const uchar pngMagicData[] = { 137, 80, 78, 71, 13, 10, 26, 10 }; - iod->seek(iconEntry.dwImageOffset); + if (!iod->seek(iconEntry.dwImageOffset) + || iconEntry.dwBytesInRes > iod->bytesAvailable()) + return img; const QByteArray pngMagic = QByteArray::fromRawData((const char*)pngMagicData, sizeof(pngMagicData)); const bool isPngImage = (iod->read(pngMagic.size()) == pngMagic); -- cgit v1.2.3