summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSlávek Banko <slavek.banko@axis.cz>2019-11-01 01:59:59 +0100
committerSlávek Banko <slavek.banko@axis.cz>2019-12-18 17:53:33 +0100
commitcd2dc5026e152d6cf57895fe4f41cabdf2bb3eca (patch)
treed65fa9099f13dd1604a8f46475db40253a77b96c
parentb90f9cb6ca34cd66f00aee1615153c88c5888452 (diff)
downloadtqt3-cd2dc5026e152d6cf57895fe4f41cabdf2bb3eca.tar.gz
tqt3-cd2dc5026e152d6cf57895fe4f41cabdf2bb3eca.zip
Fix crash in tqimage for certain malformed ppm image filesr14.0.7
The ppm format specifies that the maximum color value field must be less than 65536. The handler did not enforce this, leading to potentional overflow when the value was used in 16 bits context. Based on Qt5 patch for CVE-2018-19872. Signed-off-by: Slávek Banko <slavek.banko@axis.cz> (cherry picked from commit 4470facd61b6d9fd862f70ce56f22ab502415d23)
-rw-r--r--src/kernel/qimage.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/kernel/qimage.cpp b/src/kernel/qimage.cpp
index 0d7b9aaab..00608e79e 100644
--- a/src/kernel/qimage.cpp
+++ b/src/kernel/qimage.cpp
@@ -5196,7 +5196,7 @@ static void read_pbm_image( TQImageIO *iio ) // read PBM image data
mcc = 1; // ignore max color component
else
mcc = read_pbm_int( d ); // get max color component
- if ( w <= 0 || w > 32767 || h <= 0 || h > 32767 || mcc <= 0 )
+ if ( w <= 0 || w > 32767 || h <= 0 || h > 32767 || mcc <= 0 || mcc > 0xffff )
return; // weird P.M image
int maxc = mcc;