whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix potential truncation in write_xbm_image() 

The old code sized the buffer according to the UTF-16 size of the
input, but in fact wrote UTF-8 output, which can be up to twice as
large as UTF-16, overflowing the buffer size. Not a buffer overflow,
because qs_n_printf(), but truncation would create an invalid XBM
file here.

Fix by converting to UTF-8 first (and only once), and taking the
buffer size from there.

Introduced by 2883a6de40, which replaced
toAscii() (whose result has the same size as the input) with toUtf8()
(which can be larger).

Pick-to: 6.7 6.5
Change-Id: I4acc0816a94060520695c3e6895ed982812fdee2
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit 6d3bd0ebeacc76178fc3c4c368e04bd642881a96)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
bb10
Marc Mutz 2024-07-18 14:36:52 +02:00 committed by Qt Cherry-pick Bot
parent c8771a3082
commit 334a83e4a7
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/gui/image/qxbmhandler.cpp
View File

@ -163,15 +163,15 @@ static bool write_xbm_image(const QImage &sourceImage, QIODevice *device, const
int w = image.width();
int h = image.height();
int i;
QString s = fileName; // get file base name
const QByteArray s = fileName.toUtf8(); // get file base name
int msize = s.size() + 100;
char *buf = new char[msize];
qsnprintf(buf, msize, "#define %s_width %d\n", s.toUtf8().data(), w);
qsnprintf(buf, msize, "#define %s_width %d\n", s.data(), w);
device->write(buf, qstrlen(buf));
qsnprintf(buf, msize, "#define %s_height %d\n", s.toUtf8().data(), h);
qsnprintf(buf, msize, "#define %s_height %d\n", s.data(), h);
device->write(buf, qstrlen(buf));
qsnprintf(buf, msize, "static char %s_bits[] = {\n ", s.toUtf8().data());
qsnprintf(buf, msize, "static char %s_bits[] = {\n ", s.data());
device->write(buf, qstrlen(buf));
if (image.format() != QImage::Format_MonoLSB)