From 0870e670665a702665948723bb7b1eb61a9572a8 Mon Sep 17 00:00:00 2001
From: Marc Mutz <marc.mutz@kdab.com>
Date: Fri, 14 Oct 2016 18:33:10 +0200
Subject: [PATCH] QWbmpHandler: fix integer overflow
Both 'hdr.height' and 'hdr.width' are quint32s. Multiplying them still gives
a quint32, but the lhs expected a qint64.
Fix by casting one of the operands to qint64.
Coverity-Id: 22179
Change-Id: If7385fb42bf994d87ac4e603fa85be4a30ad6d5c
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
---
src/plugins/imageformats/wbmp/qwbmphandler.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/plugins/imageformats/wbmp/qwbmphandler.cpp b/src/plugins/imageformats/wbmp/qwbmphandler.cpp
index 0d08422d..5fe8ec9e 100644
--- a/src/plugins/imageformats/wbmp/qwbmphandler.cpp
+++ b/src/plugins/imageformats/wbmp/qwbmphandler.cpp
@@ -244,7 +244,7 @@ bool WBMPReader::canRead(QIODevice *device)
WBMPHeader hdr;
if (readWBMPHeader(device, &hdr)) {
if ((hdr.type == 0) && (hdr.format == 0)) {
- qint64 imageSize = hdr.height * ((hdr.width + 7) / 8);
+ const qint64 imageSize = hdr.height * ((qint64(hdr.width) + 7) / 8);
qint64 available = device->bytesAvailable();
device->seek(oldPos);
return (imageSize == available);
--
GitLab