1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xpm handler: fix read error caused by off-by-one in overflow check

Browse Source 
The recently introduced overflow check for 8 bit images was too
aggressive, causing the last pixel on each line to be rejected.

As a driveby, add the same (fixed) overflow check also for 32bit
images.

Fixes: QTBUG-86691
Change-Id: I62e4d5884e314f1171cb5a3e2c48657ce7259676
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
(cherry picked from commit 6f2c7469f86785e6ba81fe0280210ef7275099de)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Eirik Aavitsland 2020-09-17 16:34:12 +02:00 committed by Qt Cherry-pick Bot
parent 0d7248345d
commit fa7a839530
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/gui/image/qxpmhandler.cpp
View File

@ -973,7 +973,7 @@ static bool read_xpm_body(
} else { } else {
char b[16]; char b[16];
b[cpp] = '\0'; b[cpp] = '\0';
for (x=0; x<w && d+cpp<end; x++) { for (x = 0; x < w && d + cpp <= end; x++) {
memcpy(b, (char *)d, cpp); memcpy(b, (char *)d, cpp);
*p++ = (uchar)colorMap[xpmHash(b)]; *p++ = (uchar)colorMap[xpmHash(b)];
d += cpp; d += cpp;
@ -991,7 +991,7 @@ static bool read_xpm_body(
int x; int x;
char b[16]; char b[16];
b[cpp] = '\0'; b[cpp] = '\0';
for (x=0; x<w && d<end; x++) { for (x = 0; x < w && d + cpp <= end; x++) {
memcpy(b, (char *)d, cpp); memcpy(b, (char *)d, cpp);
*p++ = (QRgb)colorMap[xpmHash(b)]; *p++ = (QRgb)colorMap[xpmHash(b)];
d += cpp; d += cpp;