diff --git a/src/imageformats/psd.cpp b/src/imageformats/psd.cpp index 2ff94fa..c55bc50 100644 --- a/src/imageformats/psd.cpp +++ b/src/imageformats/psd.cpp @@ -28,6 +28,8 @@ #include "psd_p.h" +#include "util_p.h" + #include #include #include @@ -636,6 +638,12 @@ static bool LoadPSD(QDataStream &stream, const PSDHeader &header, QImage &img) auto imgChannels = imageChannels(img.format()); auto channel_num = std::min(qint32(header.channel_count), imgChannels); auto raw_count = qsizetype(header.width * header.depth + 7) / 8; + + if (header.height > kMaxQVectorSize / header.channel_count / sizeof(quint32)) { + qWarning() << "LoadPSD() header height/channel_count too big" << header.height << header.channel_count; + return false; + } + QVector strides(header.height * header.channel_count, raw_count); // Read the compressed stride sizes if (compression) diff --git a/src/imageformats/ras.cpp b/src/imageformats/ras.cpp index 09b9b21..ebbb482 100644 --- a/src/imageformats/ras.cpp +++ b/src/imageformats/ras.cpp @@ -9,6 +9,8 @@ #include "ras_p.h" +#include "util_p.h" + #include #include #include @@ -102,8 +104,7 @@ static bool LoadRAS(QDataStream &s, const RasHeader &ras, QImage &img) { s.device()->seek(RasHeader::SIZE); - // QVector uses some extra space for stuff, hence the 32 here suggested by thiago - if (ras.ColorMapLength > std::numeric_limits::max() - 32) { + if (ras.ColorMapLength > kMaxQVectorSize) { qWarning() << "LoadRAS() unsupported image color map length in file header" << ras.ColorMapLength; return false; } @@ -127,8 +128,7 @@ static bool LoadRAS(QDataStream &s, const RasHeader &ras, QImage &img) qWarning() << "LoadRAS() mistmatch between height and width" << ras.Width << ras.Height << ras.Length << ras.Depth; return false; } - // QVector uses some extra space for stuff, hence the 32 here suggested by thiago - if (ras.Length > std::numeric_limits::max() - 32) { + if (ras.Length > kMaxQVectorSize) { qWarning() << "LoadRAS() unsupported image length in file header" << ras.Length; return false; } diff --git a/src/imageformats/util_p.h b/src/imageformats/util_p.h new file mode 100644 index 0000000..a5b6f87 --- /dev/null +++ b/src/imageformats/util_p.h @@ -0,0 +1,10 @@ +/* + SPDX-FileCopyrightText: 2022 Albert Astals Cid + + SPDX-License-Identifier: LGPL-2.0-or-later +*/ + +#include + +// QVector uses some extra space for stuff, hence the 32 here suggested by Thiago Macieira +static constexpr int kMaxQVectorSize = std::numeric_limits::max() - 32;