From ff46bf1d82556816fa302394d5f63af7d4951b37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sl=C3=A1vek=20Banko?= Date: Mon, 28 Jan 2019 11:42:06 +0100 Subject: [PATCH] bmp image: check for out of range image size. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Make the decoder fail early to avoid spending time and memory on attempting to decode a corrupt image file. Based on Qt5 patch for CVE-2018-19873. Signed-off-by: Slávek Banko (cherry picked from commit 5a61151fe90ed84dce18998fe6c7d69ec6e49c74) --- src/kernel/qimage.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/kernel/qimage.cpp b/src/kernel/qimage.cpp index ab42e188..0d7b9aaa 100644 --- a/src/kernel/qimage.cpp +++ b/src/kernel/qimage.cpp @@ -4667,6 +4667,8 @@ bool read_dib( TQDataStream& s, int offset, int startpos, TQImage& image ) if ( !(comp == BMP_RGB || (nbits == 4 && comp == BMP_RLE4) || (nbits == 8 && comp == BMP_RLE8) || ((nbits == 16 || nbits == 32) && comp == BMP_BITFIELDS)) ) return FALSE; // weird compression type + if ((w < 0) || ((w * abs(h)) > (16384 * 16384))) + return FALSE; int ncols; int depth;