Commit 6eefe6d0 authored by Eirik Aavitsland's avatar Eirik Aavitsland Committed by Jani Heikkinen
Browse files

TGA handler: check for out of range image size


Make the decoder fail early to avoid spending time and memory on
attempting to decode a corrupt image file.

Change-Id: Iac35e72de743f412a65d11c58fe7faa275dc4e41
Reviewed-by: default avatarLars Knoll <lars.knoll@qt.io>
(cherry picked from commit 7cfe47a8)
parent 55904e96
Branches
Tags
No related merge requests found
Showing with 8 additions and 0 deletions
...@@ -163,6 +163,12 @@ QTgaFile::QTgaFile(QIODevice *device) ...@@ -163,6 +163,12 @@ QTgaFile::QTgaFile(QIODevice *device)
if (!validDepth) if (!validDepth)
{ {
mErrorMessage = tr("Image depth not valid"); mErrorMessage = tr("Image depth not valid");
return;
}
if (quint64(width()) * quint64(height()) > (8192 * 8192))
{
mErrorMessage = tr("Image size exceeds limit");
return;
} }
int curPos = mDevice->pos(); int curPos = mDevice->pos();
int fileBytes = mDevice->size(); int fileBytes = mDevice->size();
...@@ -233,6 +239,8 @@ QImage QTgaFile::readImage() ...@@ -233,6 +239,8 @@ QImage QTgaFile::readImage()
unsigned char yCorner = desc & 0x20; // 0 = lower, 1 = upper unsigned char yCorner = desc & 0x20; // 0 = lower, 1 = upper
QImage im(imageWidth, imageHeight, QImage::Format_ARGB32); QImage im(imageWidth, imageHeight, QImage::Format_ARGB32);
if (im.isNull())
return QImage();
TgaReader *reader = 0; TgaReader *reader = 0;
if (bitsPerPixel == 16) if (bitsPerPixel == 16)
reader = new Tga16Reader(); reader = new Tga16Reader();
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment