summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTarja Sundqvist <tarja.sundqvist@qt.io>2023-10-11 16:01:33 +0300
committerTarja Sundqvist <tarja.sundqvist@qt.io>2023-10-11 16:01:33 +0300
commit1019058c497e33edef80d5cb120aa7d6a418a7c6 (patch)
tree861611fd350d7b3122549f73690862ab902da447
parent6a1af670d52492ab0955933b830026b2a18ed6d6 (diff)
parentebd31cce4253ca7bad5178b1d5a552f58b836dce (diff)
Merge remote-tracking branch 'origin/tqtc/lts-5.15.12' into tqtc/lts-5.15-opensourcev5.15.12-lts-lgpl
-rw-r--r--.qmake.conf2
-rw-r--r--src/3rdparty/libtiff/libtiff/tif_lzw.c1
-rw-r--r--src/plugins/imageformats/tiff/qtiffhandler.cpp2
3 files changed, 4 insertions, 1 deletions
diff --git a/.qmake.conf b/.qmake.conf
index 259b036..0b51738 100644
--- a/.qmake.conf
+++ b/.qmake.conf
@@ -2,4 +2,4 @@ load(qt_build_config)
DEFINES += QT_NO_FOREACH QT_NO_JAVA_STYLE_ITERATORS QT_NO_LINKED_LIST
-MODULE_VERSION = 5.15.11
+MODULE_VERSION = 5.15.12
diff --git a/src/3rdparty/libtiff/libtiff/tif_lzw.c b/src/3rdparty/libtiff/libtiff/tif_lzw.c
index 096824d..8c3205f 100644
--- a/src/3rdparty/libtiff/libtiff/tif_lzw.c
+++ b/src/3rdparty/libtiff/libtiff/tif_lzw.c
@@ -39,6 +39,7 @@
#include <stdbool.h>
#include <stdio.h>
+#include <stdlib.h>
/* Select the plausible largest natural integer type for the architecture */
#define SIZEOF_WORDTYPE SIZEOF_SIZE_T
diff --git a/src/plugins/imageformats/tiff/qtiffhandler.cpp b/src/plugins/imageformats/tiff/qtiffhandler.cpp
index 1386750..ac8956c 100644
--- a/src/plugins/imageformats/tiff/qtiffhandler.cpp
+++ b/src/plugins/imageformats/tiff/qtiffhandler.cpp
@@ -361,6 +361,8 @@ bool QTiffHandler::read(QImage *image)
}
TIFF *const tiff = d->tiff;
+ if (TIFFIsTiled(tiff) && TIFFTileSize64(tiff) > uint64_t(image->sizeInBytes())) // Corrupt image
+ return false;
const quint32 width = d->size.width();
const quint32 height = d->size.height();