summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSlávek Banko <[email protected]>2019-01-28 11:47:23 +0100
committerSlávek Banko <[email protected]>2019-03-03 15:33:16 +0100
commit2fd4dcbf56b321dcbaf2a76dd51fd4d18bdd4e28 (patch)
treeab505c177682c07dfe70a364bf66e0bc31292bbd
parentac1b4232ffc2b02bc4ab2e04e5451fa40b62a93e (diff)
downloadqt3-2fd4dcbf56b321dcbaf2a76dd51fd4d18bdd4e28.tar.gz
qt3-2fd4dcbf56b321dcbaf2a76dd51fd4d18bdd4e28.zip
bmp image: check for out of range image size.r14.0.6
Make the decoder fail early to avoid spending time and memory on attempting to decode a corrupt image file. Based on Qt5 patch for CVE-2018-19873. Signed-off-by: Slávek Banko <[email protected]> (cherry picked from commit a00e43bd1ce54de39f807ae5acbcaa52b15be844)
-rw-r--r--src/kernel/qimage.cpp2
1 files changed, 2 insertions, 0 deletions
diff --git a/src/kernel/qimage.cpp b/src/kernel/qimage.cpp
index 60a9a5d..8dd71be 100644
--- a/src/kernel/qimage.cpp
+++ b/src/kernel/qimage.cpp
@@ -4667,6 +4667,8 @@ bool read_dib( QDataStream& s, int offset, int startpos, QImage& image )
if ( !(comp == BMP_RGB || (nbits == 4 && comp == BMP_RLE4) ||
(nbits == 8 && comp == BMP_RLE8) || ((nbits == 16 || nbits == 32) && comp == BMP_BITFIELDS)) )
return FALSE; // weird compression type
+ if ((w < 0) || ((w * abs(h)) > (16384 * 16384)))
+ return FALSE;
int ncols;
int depth;