mirror/kimageformats
1
0
Fork 0
mirror of https://invent.kde.org/frameworks/kimageformats.git synced 2025-06-03 17:08:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

ras: fail gracefully on height*width*bpp > length

Browse Source 
oss-fuzz/12822
This commit is contained in:
Albert Astals Cid 2019-02-03 13:38:44 +01:00
parent dd95a5bd0e
commit 1a31500e55
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/imageformats/ras.cpp
View File

@ -110,9 +110,15 @@ static bool LoadRAS(QDataStream &s, const RasHeader &ras, QImage &img)
}
}
const int bpp = ras.Depth / 8;
if (ras.Length / ras.Height / bpp < ras.Width) {
qWarning() << "LoadRAS() mistmatch between height and width" << ras.Width << ras.Height << ras.Length << ras.Depth;
return false;
}
// each line must be a factor of 16 bits, so they may contain padding
// this will be 1 if padding required, 0 otherwise
int paddingrequired = (ras.Width * (ras.Depth / 8) % 2);
const int paddingrequired = (ras.Width * bpp % 2);
// qDebug() << "paddingrequired: " << paddingrequired;
// don't trust ras.Length
@ -122,7 +128,7 @@ static bool LoadRAS(QDataStream &s, const RasHeader &ras, QImage &img)
while (! s.atEnd()) {
s >> input[i];
// I guess we need to find out if we're at the end of a line
if (paddingrequired && i != 0 && !(i % (ras.Width * (ras.Depth / 8)))) {
if (paddingrequired && i != 0 && !(i % (ras.Width * bpp))) {
s >> input[i];
}
i++;