diff options
| author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2021-10-25 14:43:09 +0200 |
|---|---|---|
| committer | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2021-11-08 16:49:19 +0200 |
| commit | e544d8e457d52b543cae5c988f81237c7d6608da (patch) | |
| tree | 42bab8d1001993e0a90eef1489ce0f1a13e15f9c | |
| parent | 1079e72bd78d396297fac22dec58bb343a34887e (diff) | |
| download | qtsvg-e544d8e457d52b543cae5c988f81237c7d6608da.tar.gz | |
SVG Image reading: Reject oversize svgs as corrupt
Add an upper limit for height and width at 0xffff, same as jpeg.
Fixes: QTBUG-95891
Pick-to: 6.2 5.15 5.12
Change-Id: I0dbc80dab3aab9b4743548772fb63fa69ea21f8a
Reviewed-by: Robert Löhning <robert.loehning@qt.io>
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
| -rw-r--r-- | src/plugins/imageformats/svg/qsvgiohandler.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/plugins/imageformats/svg/qsvgiohandler.cpp b/src/plugins/imageformats/svg/qsvgiohandler.cpp index 3e338b3..309e892 100644 --- a/src/plugins/imageformats/svg/qsvgiohandler.cpp +++ b/src/plugins/imageformats/svg/qsvgiohandler.cpp @@ -184,6 +184,8 @@ bool QSvgIOHandler::read(QImage *image) if (finalSize.isEmpty()) { *image = QImage(); } else { + if (qMax(finalSize.width(), finalSize.height()) > 0xffff) + return false; // Assume corrupted file if (!QImageIOHandler::allocateImage(finalSize, QImage::Format_ARGB32_Premultiplied, image)) return false; image->fill(d->backColor.rgba()); |