whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid potential ub in corrupt bmp file 

biHeight may be int_min, in which case qAbs<int>() will not work.

Fixes: oss-fuzz-22997
Pick-to: 5.15 5.12
Change-Id: Ic07d5aa0b4e4f2b6395e1a12d742e31b5282fdfc
Reviewed-by: Robert Loehning <robert.loehning@qt.io>
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
bb10
Eirik Aavitsland 2020-06-15 15:57:05 +02:00
parent e22c0368d8
commit 6f909a5178
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/gui/image/qbmphandler.cpp
View File

@ -188,6 +188,8 @@ static bool read_dib_infoheader(QDataStream &s, BMP_INFOHDR &bi)
if (!(comp == BMP_RGB || (nbits == 4 && comp == BMP_RLE4) ||
(nbits == 8 && comp == BMP_RLE8) || ((nbits == 16 || nbits == 32) && comp == BMP_BITFIELDS)))
return false; // weird compression type
if (bi.biHeight == INT_MIN)
return false; // out of range for positive int
if (bi.biWidth <= 0 || !bi.biHeight || quint64(bi.biWidth) * qAbs(bi.biHeight) > 16384 * 16384)
return false;