AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix memory copy in QGIFFormat::disposePrevious()

Browse Source 
Fix invalid destination address in memcpy operation when RestoreImage disposal method is used.

Task-number: QTBUG-71599
Change-Id: Ib74a044c0e45250ff708268c463f831ee54933e6
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
This commit is contained in:
Andrew Smolko 2018-11-06 11:20:34 +03:00
parent 033cc3403a
commit 9f2216667a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/plugins/imageformats/gif/qgifhandler.cpp
View File

@ -213,7 +213,7 @@ void QGIFFormat::disposePrevious(QImage *image)
case RestoreImage: { case RestoreImage: {
if (frame >= 0) { if (frame >= 0) {
for (int ln=t; ln<=b; ln++) { for (int ln=t; ln<=b; ln++) {
memcpy(image->scanLine(ln)+l, memcpy(image->scanLine(ln)+l*sizeof(QRgb),
backingstore.constScanLine(ln-t), backingstore.constScanLine(ln-t),
(r-l+1)*sizeof(QRgb)); (r-l+1)*sizeof(QRgb));
} }
@ -426,7 +426,7 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
unsigned char *dest_data = backingstore.bits(); unsigned char *dest_data = backingstore.bits();
for (int ln=0; ln<h; ln++) { for (int ln=0; ln<h; ln++) {
memcpy(FAST_SCAN_LINE(dest_data, dest_bpl, ln), memcpy(FAST_SCAN_LINE(dest_data, dest_bpl, ln),
FAST_SCAN_LINE(bits, bpl, t+ln) + l, w*sizeof(QRgb)); FAST_SCAN_LINE(bits, bpl, t+ln) + l*sizeof(QRgb), w*sizeof(QRgb));
} }
} }