blob: cfbbe0f755c49605257bc23155f646ec63e510c2 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
commit eb1325047f2697d24e93ebaf924900affc876bc1
Author: Lars Knoll <lars.knoll@digia.com>
Date: Thu Apr 24 15:33:27 2014 +0200
Don't crash on broken GIF images
Broken GIF images could set invalid width and height
values inside the image, leading to Qt creating a null
QImage for it. In that case we need to abort decoding
the image and return an error.
Initial patch by Rich Moore.
Task-number: QTBUG-38367
Change-Id: Id82a4036f478bd6e49c402d6598f57e7e5bb5e1e
Security-advisory: CVE-2014-0190
Reviewed-by: Richard J. Moore <rich@kde.org>
diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
index eeb62af..19b8382 100644
--- src/gui/image/qgifhandler.cpp
+++ src/gui/image/qgifhandler.cpp
@@ -359,6 +359,13 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
memset(bits, 0, image->byteCount());
}
+ // Check if the previous attempt to create the image failed. If it
+ // did then the image is broken and we should give up.
+ if (image->isNull()) {
+ state = Error;
+ return -1;
+ }
+
disposePrevious(image);
disposed = false;
|
