Filters: check image allocation to avoid memory exhaustion and crash

The new svg features introduced in 6.7 generally use the checked
QImage allocation from ImageIO to create the intermediate images. The
exception was in applyFilter(), where a QImage was created by the copy
function.

This commit does not fix the underlying problem in the filter size
calculation. It just ensures that the code fails cleanly, whatever the
reason for the unexpected size.

Pick-to: 6.7
Task-number: QTBUG-124287
Change-Id: If1a20b11842cc05645fe16aa9f4158190f28f5b2
Reviewed-by: Hatem ElKharashy <hatem.elkharashy@qt.io>

1 files changed, 6 insertions, 1 deletions

diff --git a/src/svg/qsvgstructure.cpp b/src/svg/qsvgstructure.cpp
index 2ed6a70..22f1b0d 100644
--- a/src/svg/qsvgstructure.cpp
+++ b/src/svg/qsvgstructure.cpp
@@ -385,7 +385,12 @@ QImage QSvgFilterContainer::applyFilter(QSvgNode *item, const QImage &buffer, QP
     if (filterBoundsGlobRel.isEmpty())
         return buffer;
 
-    QImage proxy = buffer.copy(filterBoundsGlobRel);
+    QImage proxy;
+    if (!QImageIOHandler::allocateImage(filterBoundsGlobRel.size(), buffer.format(), &proxy)) {
+        qCWarning(lcSvgDraw) << "The requested filter is too big, ignoring";
+        return buffer;
+    }
+    proxy = buffer.copy(filterBoundsGlobRel);
     proxy.setOffset(filterBoundsGlob.topLeft());
     if (proxy.isNull())
         return buffer;