whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix crash in qppmhandler for certain malformed image files 

The ppm format specifies that the maximum color value field must be
less than 65536. The handler did not enforce this, leading to
potentional overflow when the value was used in 16 bits context.

Task-number: QTBUG-69449
Change-Id: Iea7a7e0f8953ec1ea8571e215687d12a9d77e11c
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
bb10
Eirik Aavitsland 2018-08-02 13:11:20 +02:00
parent 9d4d05ec53
commit 8c4207dddf
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/gui/image/qppmhandler.cpp
View File

@ -115,7 +115,7 @@ static bool read_pbm_header(QIODevice *device, char& type, int& w, int& h, int&
else
mcc = read_pbm_int(device); // get max color component
if (w <= 0 || w > 32767 || h <= 0 || h > 32767 || mcc <= 0)
if (w <= 0 || w > 32767 || h <= 0 || h > 32767 || mcc <= 0 || mcc > 0xffff)
return false; // weird P.M image
return true;