From af84313c622af880e95d461ea8b7dbca58d2dffa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Samuel=20R=C3=B8dal?= Date: Tue, 5 Feb 2013 09:44:26 +0100 Subject: Fixed crash in image reader when reading certain BMP files. If the high bit in a mask is set, for instance if the mask is 0xff000000, and we shift it to the right by 24 positions, since the mask was not declared as unsigned we ended up with a mask value of 0xffffffff. We then add 1 to this value and divide by the result, causing a division by zero crash. The masks need to be declared unsigned to prevent sign bit extension when shifting right. Task-number: QTBUG-29194 Change-Id: I79260344cebfbdd3ea86416a9c734dca76517999 Reviewed-by: Gunnar Sletta --- src/gui/image/qbmphandler.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp index 062714c769..6abde5e420 100644 --- a/src/gui/image/qbmphandler.cpp +++ b/src/gui/image/qbmphandler.cpp @@ -143,7 +143,7 @@ static QDataStream &operator<<(QDataStream &s, const BMP_INFOHDR &bi) return s; } -static int calc_shift(int mask) +static int calc_shift(uint mask) { int result = 0; while (mask && !(mask & 1)) { @@ -207,9 +207,9 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int #endif int w = bi.biWidth, h = bi.biHeight, nbits = bi.biBitCount; int t = bi.biSize, comp = bi.biCompression; - int red_mask = 0; - int green_mask = 0; - int blue_mask = 0; + uint red_mask = 0; + uint green_mask = 0; + uint blue_mask = 0; int red_shift = 0; int green_shift = 0; int blue_shift = 0; -- cgit v1.2.3