diff options
author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2018-08-03 13:25:15 +0200 |
---|---|---|
committer | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2018-08-07 09:21:50 +0000 |
commit | f9324103a0f824de2c5243f07a86e7906b8a8ea6 (patch) | |
tree | 50ba1c7abebbbbcb0d51994703e80678eea49e1a | |
parent | 805dce07b9797f5f2770a9d2c58d6d381784ca25 (diff) | |
download | qtbase-f9324103a0f824de2c5243f07a86e7906b8a8ea6.tar.gz |
Check for QImage allocation failure in qgifhandler
Since image files easily can be (or corrupt files claim to be) huge,
it is worth checking for out of memory situations.
Change-Id: I635a3ec6852288079fdec4e14cf7e776fe59e9e0
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
(cherry picked from commit 2841e2b61e32f26900bde987d469c8b97ea31999)
-rw-r--r-- | src/plugins/imageformats/gif/qgifhandler.cpp | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp index bae74bf9a1..84ef61b219 100644 --- a/src/plugins/imageformats/gif/qgifhandler.cpp +++ b/src/plugins/imageformats/gif/qgifhandler.cpp @@ -354,7 +354,8 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, (*image) = QImage(swidth, sheight, format); bpl = image->bytesPerLine(); bits = image->bits(); - memset(bits, 0, image->byteCount()); + if (bits) + memset(bits, 0, image->byteCount()); } // Check if the previous attempt to create the image failed. If it @@ -415,6 +416,10 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, backingstore = QImage(qMax(backingstore.width(), w), qMax(backingstore.height(), h), QImage::Format_RGB32); + if (backingstore.isNull()) { + state = Error; + return -1; + } memset(backingstore.bits(), 0, backingstore.byteCount()); } const int dest_bpl = backingstore.bytesPerLine(); |