1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle para tags the same way for OOB checks as the other tags

Browse Source 
Do not include the first parameter in the main tag anymore. That is
a left over from before unaligned access was added.

Change-Id: I2caf027c6b9930d3e23fe5ec8bdcd45db34835a9
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
(cherry picked from commit b984689ec881ffb2cf2ee56f98cfaa1e2a4da54a)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Allan Sandfeld Jensen 2021-02-26 13:16:16 +01:00 committed by Qt Cherry-pick Bot
parent cdf4976b5a
commit c3c76517dd
1 changed files with 16 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
src/gui/painting/qicc.cpp
View File

@ -171,7 +171,7 @@ struct CurvTagData : GenericTagData {
struct ParaTagData : GenericTagData { struct ParaTagData : GenericTagData {
quint16_be curveType; quint16_be curveType;
quint16_be null2; quint16_be null2;
quint32_be parameter[1]; // followed by parameter values: quint32_be[1-7];
}; };
struct DescTagData : GenericTagData { struct DescTagData : GenericTagData {
@ -507,26 +507,24 @@ bool parseTRC(const QByteArray &data, const TagEntry &tagEntry, QColorTrc &gamma
return true; return true;
} }
if (trcData.type == quint32(Tag::para)) { if (trcData.type == quint32(Tag::para)) {
if (tagEntry.size < sizeof(ParaTagData)) Q_STATIC_ASSERT(sizeof(ParaTagData) == 12);
return false;
static_assert(sizeof(GenericTagData) == 2 * sizeof(quint32_be),
"GenericTagData has padding. The following code is a subject to UB.");
const ParaTagData para = qFromUnaligned<ParaTagData>(data.constData() + tagEntry.offset); const ParaTagData para = qFromUnaligned<ParaTagData>(data.constData() + tagEntry.offset);
// re-read first parameter for consistency: const auto parametersOffset = tagEntry.offset + sizeof(ParaTagData);
const auto parametersOffset = tagEntry.offset + sizeof(GenericTagData) quint32 parameters[7];
+ 2 * sizeof(quint16_be);
switch (para.curveType) { switch (para.curveType) {
case 0: { case 0: {
float g = fromFixedS1516(para.parameter[0]); if (tagEntry.size < sizeof(ParaTagData) + 1 * 4)
return false;
qFromBigEndian<quint32>(data.constData() + parametersOffset, 1, parameters);
float g = fromFixedS1516(parameters[0]);
gamma.m_type = QColorTrc::Type::Function; gamma.m_type = QColorTrc::Type::Function;
gamma.m_fun = QColorTransferFunction::fromGamma(g); gamma.m_fun = QColorTransferFunction::fromGamma(g);
break; break;
} }
case 1: { case 1: {
if (tagEntry.size < sizeof(ParaTagData) + 2 * 4) if (tagEntry.size < sizeof(ParaTagData) + 3 * 4)
return false; return false;
std::array<quint32_be, 3> parameters = qFromBigEndian<quint32>(data.constData() + parametersOffset, 3, parameters);
qFromUnaligned<decltype(parameters)>(data.constData() + parametersOffset);
if (parameters[1] == 0) if (parameters[1] == 0)
return false; return false;
float g = fromFixedS1516(parameters[0]); float g = fromFixedS1516(parameters[0]);
@ -538,10 +536,9 @@ bool parseTRC(const QByteArray &data, const TagEntry &tagEntry, QColorTrc &gamma
break; break;
} }
case 2: { case 2: {
if (tagEntry.size < sizeof(ParaTagData) + 3 * 4) if (tagEntry.size < sizeof(ParaTagData) + 4 * 4)
return false; return false;
std::array<quint32_be, 4> parameters = qFromBigEndian<quint32>(data.constData() + parametersOffset, 4, parameters);
qFromUnaligned<decltype(parameters)>(data.constData() + parametersOffset);
if (parameters[1] == 0) if (parameters[1] == 0)
return false; return false;
float g = fromFixedS1516(parameters[0]); float g = fromFixedS1516(parameters[0]);
@ -554,10 +551,9 @@ bool parseTRC(const QByteArray &data, const TagEntry &tagEntry, QColorTrc &gamma
break; break;
} }
case 3: { case 3: {
if (tagEntry.size < sizeof(ParaTagData) + 4 * 4) if (tagEntry.size < sizeof(ParaTagData) + 5 * 4)
return false; return false;
std::array<quint32_be, 5> parameters = qFromBigEndian<quint32>(data.constData() + parametersOffset, 5, parameters);
qFromUnaligned<decltype(parameters)>(data.constData() + parametersOffset);
float g = fromFixedS1516(parameters[0]); float g = fromFixedS1516(parameters[0]);
float a = fromFixedS1516(parameters[1]); float a = fromFixedS1516(parameters[1]);
float b = fromFixedS1516(parameters[2]); float b = fromFixedS1516(parameters[2]);
@ -568,10 +564,9 @@ bool parseTRC(const QByteArray &data, const TagEntry &tagEntry, QColorTrc &gamma
break; break;
} }
case 4: { case 4: {
if (tagEntry.size < sizeof(ParaTagData) + 6 * 4) if (tagEntry.size < sizeof(ParaTagData) + 7 * 4)
return false; return false;
std::array<quint32_be, 7> parameters = qFromBigEndian<quint32>(data.constData() + parametersOffset, 7, parameters);
qFromUnaligned<decltype(parameters)>(data.constData() + parametersOffset);
float g = fromFixedS1516(parameters[0]); float g = fromFixedS1516(parameters[0]);
float a = fromFixedS1516(parameters[1]); float a = fromFixedS1516(parameters[1]);
float b = fromFixedS1516(parameters[2]); float b = fromFixedS1516(parameters[2]);