diff options
| -rw-r--r-- | src/svg/qsvgtinydocument.cpp | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/svg/qsvgtinydocument.cpp b/src/svg/qsvgtinydocument.cpp index 9e5da82..295f535 100644 --- a/src/svg/qsvgtinydocument.cpp +++ b/src/svg/qsvgtinydocument.cpp @@ -127,6 +127,12 @@ QByteArray qt_inflateGZipDataFrom(QIODevice *device) do { // Prepare the destination buffer int oldSize = destination.size(); + if (oldSize > INT_MAX - CHUNK_SIZE) { + inflateEnd(&zlibStream); + qCWarning(lcSvgHandler, "Error while inflating gzip file: integer size overflow"); + return destination; + } + destination.resize(oldSize + CHUNK_SIZE); zlibStream.next_out = reinterpret_cast<Bytef*>( destination.data() + oldSize - zlibStream.avail_out); |