AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Crash fix: reject certain malformed bmp images

Browse Source 
A malformed bmp file header could specify a negative color table
size. The bmp handler would then return a QImage that claimed to be
valid, but actually was invalid, having an empty color table. This
would cause crash later, e.g. when attempting to paint it.

Change-Id: I7df7c40867557a82dbcee44c7de061226ff232c0
Reviewed-by: Lars Knoll <lars.knoll@theqtcompany.com>
Reviewed-by: Richard J. Moore <rich@kde.org>
This commit is contained in:
Eirik Aavitsland 2016-02-02 14:06:28 +01:00 committed by Jani Heikkinen
parent 786d23bb49
commit e4f71b0cb5
3 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/gui/image/qbmphandler.cpp
View File

@ -294,7 +294,7 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
if (depth != 32) {
ncols = bi.biClrUsed ? bi.biClrUsed : 1 << nbits;
if (ncols > 256) // sanity check - don't run out of mem if color table is broken
if (ncols < 1 || ncols > 256) // sanity check - don't run out of mem if color table is broken
return false;
image.setColorCount(ncols);
}

BIN
tests/auto/gui/image/qimagereader/images/corrupt_clut.bmp Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 368 B

1
tests/auto/gui/image/qimagereader/tst_qimagereader.cpp
View File

@ -1482,6 +1482,7 @@ void tst_QImageReader::readCorruptImage_data()
QTest::newRow("corrupt gif") << QString("corrupt.gif") << true << QString("") << QByteArray("gif");
QTest::newRow("corrupt png") << QString("corrupt.png") << true << QString("") << QByteArray("png");
QTest::newRow("corrupt bmp") << QString("corrupt.bmp") << true << QString("") << QByteArray("bmp");
QTest::newRow("corrupt bmp (clut)") << QString("corrupt_clut.bmp") << true << QString("") << QByteArray("bmp");
QTest::newRow("corrupt xpm (colors)") << QString("corrupt-colors.xpm") << true
<< QString("QImage: XPM color specification is missing: bla9an.n#x")
<< QByteArray("xpm");