From 85485845bdf502674edf4d5b840f0194e62da7bb Mon Sep 17 00:00:00 2001 From: Eirik Aavitsland Date: Mon, 25 Oct 2021 14:43:09 +0200 Subject: SVG Image reading: Reject oversize svgs as corrupt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add an upper limit for height and width at 0xffff, same as jpeg. Fixes: QTBUG-95891 Change-Id: I0dbc80dab3aab9b4743548772fb63fa69ea21f8a Reviewed-by: Robert Löhning Reviewed-by: Allan Sandfeld Jensen (cherry picked from commit e544d8e457d52b543cae5c988f81237c7d6608da) Reviewed-by: Eirik Aavitsland --- src/plugins/imageformats/svg/qsvgiohandler.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/plugins/imageformats/svg/qsvgiohandler.cpp b/src/plugins/imageformats/svg/qsvgiohandler.cpp index 5e96d27..5011da9 100644 --- a/src/plugins/imageformats/svg/qsvgiohandler.cpp +++ b/src/plugins/imageformats/svg/qsvgiohandler.cpp @@ -177,6 +177,8 @@ bool QSvgIOHandler::read(QImage *image) bounds = t.mapRect(bounds); } if (image->size() != finalSize || !image->reinterpretAsFormat(QImage::Format_ARGB32_Premultiplied)) { + if (qMax(finalSize.width(), finalSize.height()) > 0xffff) + return false; // Assume corrupted file *image = QImage(finalSize, QImage::Format_ARGB32_Premultiplied); if (!finalSize.isEmpty() && image->isNull()) { qWarning("QSvgIOHandler: QImage allocation failed (size %i x %i)", finalSize.width(), finalSize.height()); -- cgit v1.2.1