GIT_SILENT Upgrade ECM and KF5 version requirements for 5.72.0 release.

Since QImage does sanity checking for overflows and stuff wrt.
dimensions and depth, check for QImage::isNull() as early as possible to
see if there's some funky business going on.

Also tried to add some checks wherever we wrote to "raw" memory.

Unit tests pass, and tested converting some files from
https://samples.ffmpeg.org/image-samples/ to pngs, and that seemed to
work.

Reviewed By: aacid

Differential Revision: https://phabricator.kde.org/D24367

.arcconfig

@@ -1,3 +0,0 @@
-{
-  "phabricator.uri" : "https://phabricator.kde.org/"
-}

.gitignore

@@ -0,0 +1,22 @@
+# Ignore the following files
+*~
+*.[oa]
+*.diff
+*.kate-swp
+*.kdev4
+.kdev_include_paths
+*.kdevelop.pcs
+*.moc
+*.moc.cpp
+*.orig
+*.user
+.*.swp
+.swp.*
+Doxyfile
+Makefile
+avail
+random_seed
+/build*/
+CMakeLists.txt.user*
+*.unc-backup*
+.cmake/

CMakeLists.txt

@@ -2,13 +2,15 @@ cmake_minimum_required(VERSION 3.5)
 
 project(KImageFormats)
 
+set (CMAKE_CXX_STANDARD 14)
+
 include(FeatureSummary)
-find_package(ECM 5.56.0  NO_MODULE)
-set_package_properties(ECM PROPERTIES TYPE REQUIRED DESCRIPTION "Extra CMake Modules." URL "https://projects.kde.org/projects/kdesupport/extra-cmake-modules")
+find_package(ECM 5.72.0  NO_MODULE)
+set_package_properties(ECM PROPERTIES TYPE REQUIRED DESCRIPTION "Extra CMake Modules." URL "https://commits.kde.org/extra-cmake-modules")
 feature_summary(WHAT REQUIRED_PACKAGES_NOT_FOUND FATAL_ON_MISSING_REQUIRED_PACKAGES)
 
 
-set(CMAKE_MODULE_PATH ${ECM_MODULE_PATH} ${ECM_KDE_MODULE_DIR})
+set(CMAKE_MODULE_PATH ${ECM_MODULE_PATH})
 
 include(KDEInstallDirs)
 include(KDEFrameworkCompilerSettings NO_POLICY_SCOPE)
@@ -17,7 +19,7 @@ include(KDECMakeSettings)
 
 include(CheckIncludeFiles)
 
-set(REQUIRED_QT_VERSION 5.10.0)
+set(REQUIRED_QT_VERSION 5.12.0)
 find_package(Qt5Gui ${REQUIRED_QT_VERSION} REQUIRED NO_MODULE)
 
 find_package(KF5Archive)
@@ -46,6 +48,10 @@ set_package_properties(OpenEXR PROPERTIES
     PURPOSE "Required for the QImage plugin for OpenEXR images"
 )
 add_definitions(-DQT_NO_FOREACH)
+# 050d00 (5.13) triggers a BIC in qimageiohandler.h, in Qt 5.13, so do not enable that until we can require 5.14
+# https://codereview.qt-project.org/c/qt/qtbase/+/279215
+add_definitions(-DQT_DISABLE_DEPRECATED_BEFORE=0x050c00)
+add_definitions(-DKF_DISABLE_DEPRECATED_BEFORE_AND_AT=0x054700)
 add_subdirectory(src)
 if (BUILD_TESTING)
     add_subdirectory(autotests)

autotests/CMakeLists.txt

@@ -55,6 +55,7 @@ endmacro()
 # Loads each <format> image in read/<format>/, and compares the
 # result against the data read from the corresponding png file
 kimageformats_read_tests(
+    hdr
     pcx
     psd
     ras

autotests/pictest.cpp

@@ -210,11 +210,11 @@ private Q_SLOTS:
             QFile picDumpFile(fileNameBase + QStringLiteral("-expected.data"));
             QVERIFY2(picDumpFile.open(QIODevice::WriteOnly), qPrintable(picDumpFile.errorString()));
             picDumpFile.write(reinterpret_cast<const char *>(inputImage.bits()),
-                              inputImage.byteCount());
+                              inputImage.sizeInBytes());
             QFile pngDumpFile(fileNameBase + QStringLiteral("-actual.data"));
             QVERIFY2(pngDumpFile.open(QIODevice::WriteOnly), qPrintable(pngDumpFile.errorString()));
             pngDumpFile.write(reinterpret_cast<const char *>(expImage.bits()),
-                              expImage.byteCount());
+                              expImage.sizeInBytes());
             QString msg = QStringLiteral("Read image (")
                         + picDumpFile.fileName()
                         + QStringLiteral(") differed from expected image (")

autotests/readtest.cpp

@@ -35,8 +35,8 @@ static void writeImageData(const char *name, const QString &filename, const QIma
 {
     QFile file(filename);
     if (file.open(QIODevice::WriteOnly)) {
-        qint64 written = file.write(reinterpret_cast<const char *>(image.bits()), image.byteCount());
-        if (written == image.byteCount()) {
+        qint64 written = file.write(reinterpret_cast<const char *>(image.bits()), image.sizeInBytes());
+        if (written == image.sizeInBytes()) {
             QTextStream(stdout) << "       " << name
                                 << " written to " << filename << "\n";
         } else {
@@ -127,6 +127,12 @@ int main(int argc, char ** argv)
         << "Starting basic read tests for "
         << suffix << " images *********\n";
 
+    const QList<QByteArray> formats = QImageReader::supportedImageFormats();
+    QStringList formatStrings;
+    formatStrings.reserve(formats.size());
+    std::transform(formats.begin(), formats.end(), std::back_inserter(formatStrings), [](const QByteArray &format) { return QString(format); });
+    QTextStream(stdout) << "QImageReader::supportedImageFormats: " << formatStrings.join(", ") << "\n";
+
     const QFileInfoList lstImgDir = imgdir.entryInfoList();
     for (const QFileInfo &fi : lstImgDir) {
         int suffixPos = fi.filePath().count() - suffix.count();
@@ -134,7 +140,7 @@ int main(int argc, char ** argv)
         QString expfile = fi.filePath().replace(suffixPos, suffix.count(), QStringLiteral("png"));
         QString expfilename = QFileInfo(expfile).fileName();
 
-        QImageReader inputReader(inputfile, format.constData());
+        QImageReader inputReader(inputfile, format);
         QImageReader expReader(expfile, "png");
 
         QImage inputImage;
@@ -148,6 +154,14 @@ int main(int argc, char ** argv)
             ++failed;
             continue;
         }
+        if (!inputReader.canRead()) {
+            QTextStream(stdout) << "FAIL : " << fi.fileName()
+                << ": failed can read: "
+                << inputReader.errorString()
+                << "\n";
+            ++failed;
+            continue;
+        }
         if (!inputReader.read(&inputImage)) {
             QTextStream(stdout) << "FAIL : " << fi.fileName()
                 << ": failed to load: "

src/imageformats/CMakeLists.txt

@@ -53,6 +53,11 @@ endif()
 
 ##################################
 
+kimageformats_add_plugin(kimg_hdr JSON "hdr.json" SOURCES hdr.cpp)
+install(FILES hdr.desktop DESTINATION ${KDE_INSTALL_KSERVICES5DIR}/qimageioplugins/)
+
+##################################
+
 kimageformats_add_plugin(kimg_pcx JSON "pcx.json" SOURCES pcx.cpp)
 install(FILES pcx.desktop DESTINATION ${KDE_INSTALL_KSERVICES5DIR}/qimageioplugins/)
 

src/imageformats/eps.cpp

@@ -17,7 +17,7 @@
 #include <QCoreApplication>
 
 // logging category for this framework, default: log stuff >= warning
-Q_LOGGING_CATEGORY(EPSPLUGIN, "epsplugin", QtWarningMsg)
+Q_LOGGING_CATEGORY(EPSPLUGIN, "kf5.kimageformats.epsplugin", QtWarningMsg)
 
 //#define EPS_PERFORMANCE_DEBUG 1
 

src/imageformats/exr.cpp

@@ -82,7 +82,7 @@ void K_IStream::clear()
  * format into the normal 32 bit pixel format. Process is from the
  * ILM code.
  */
-QRgb RgbaToQrgba(struct Imf::Rgba imagePixel)
+QRgb RgbaToQrgba(struct Imf::Rgba &imagePixel)
 {
     float r, g, b, a;
 
@@ -172,17 +172,18 @@ bool EXRHandler::read(QImage *outImage)
         width  = dw.max.x - dw.min.x + 1;
         height = dw.max.y - dw.min.y + 1;
 
+        QImage image(width, height, QImage::Format_RGB32);
+        if (image.isNull()) {
+            qWarning() << "Failed to allocate image, invalid size?" << QSize(width, height);
+            return false;
+        }
+
         Imf::Array2D<Imf::Rgba> pixels;
         pixels.resizeErase(height, width);
 
         file.setFrameBuffer(&pixels[0][0] - dw.min.x - dw.min.y * width, 1, width);
         file.readPixels(dw.min.y, dw.max.y);
 
-        QImage image(width, height, QImage::Format_RGB32);
-        if (image.isNull()) {
-            return false;
-        }
-
         // somehow copy pixels into image
         for (int y = 0; y < height; y++) {
             for (int x = 0; x < width; x++) {

src/imageformats/gimp_p.h

@@ -56,16 +56,6 @@ typedef enum {
     INDEXED
 } GimpImageBaseType;
 
-//! Type of individual layers in an XCF file.
-
-typedef enum {
-    RGB_GIMAGE,
-    RGBA_GIMAGE,
-    GRAY_GIMAGE,
-    GRAYA_GIMAGE,
-    INDEXED_GIMAGE,
-    INDEXEDA_GIMAGE
-} GimpImageType;
 
 // From GIMP "libgimp/gimpenums.h" v2.4
 
@@ -96,49 +86,6 @@ typedef enum {
     GRAIN_MERGE_MODE
 } LayerModeEffects;
 
-// From GIMP "xcf.c" v1.2
-
-//! Properties which can be stored in an XCF file.
-
-typedef enum {
-    PROP_END = 0,
-    PROP_COLORMAP = 1,
-    PROP_ACTIVE_LAYER = 2,
-    PROP_ACTIVE_CHANNEL = 3,
-    PROP_SELECTION = 4,
-    PROP_FLOATING_SELECTION = 5,
-    PROP_OPACITY = 6,
-    PROP_MODE = 7,
-    PROP_VISIBLE = 8,
-    PROP_LINKED = 9,
-    PROP_PRESERVE_TRANSPARENCY = 10,
-    PROP_APPLY_MASK = 11,
-    PROP_EDIT_MASK = 12,
-    PROP_SHOW_MASK = 13,
-    PROP_SHOW_MASKED = 14,
-    PROP_OFFSETS = 15,
-    PROP_COLOR = 16,
-    PROP_COMPRESSION = 17,
-    PROP_GUIDES = 18,
-    PROP_RESOLUTION = 19,
-    PROP_TATTOO = 20,
-    PROP_PARASITES = 21,
-    PROP_UNIT = 22,
-    PROP_PATHS = 23,
-    PROP_USER_UNIT = 24,
-    MAX_SUPPORTED_PROPTYPE // should always be at the end so its value is last + 1
-} PropType;
-
-// From GIMP "xcf.c" v1.2
-
-//! Compression type used in layer tiles.
-
-typedef enum {
-    COMPRESS_NONE = 0,
-    COMPRESS_RLE = 1,
-    COMPRESS_ZLIB = 2,
-    COMPRESS_FRACTAL = 3  /* Unused. */
-} CompressionType;
 
 // From GIMP "paint_funcs.c" v1.2
 

src/imageformats/hdr.cpp

@@ -12,10 +12,14 @@
 
 #include <QImage>
 #include <QDataStream>
+#include <QLoggingCategory>
+#include <QRegularExpressionMatch>
 
 #include <QDebug>
 
-typedef Q_UINT8 uchar;
+typedef unsigned char uchar;
+
+Q_LOGGING_CATEGORY(HDRPLUGIN, "kf5.kimageformats.hdrplugin", QtWarningMsg)
 
 namespace   // Private.
 {
@@ -93,19 +97,23 @@ static bool LoadHDR(QDataStream &s, const int width, const int height, QImage &i
     uchar val, code;
 
     // Create dst image.
-    if (!img.create(width, height, 32)) {
+    img = QImage(width, height, QImage::Format_RGB32);
+    if (img.isNull()) {
+        qCDebug(HDRPLUGIN) << "Couldn't create image with size" << width << height << "and format RGB32";
         return false;
     }
 
-    QMemArray<uchar> image(width * 4);
+    QByteArray lineArray;
+    lineArray.resize(4 * width);
+    uchar *image = (uchar *) lineArray.data();
 
     for (int cline = 0; cline < height; cline++) {
         QRgb *scanline = (QRgb *) img.scanLine(cline);
 
         // determine scanline type
         if ((width < MINELEN) || (MAXELEN < width)) {
-            Read_Old_Line(image.data(), width, s);
-            RGBE_To_QRgbLine(image.data(), scanline, width);
+            Read_Old_Line(image, width, s);
+            RGBE_To_QRgbLine(image, scanline, width);
             continue;
         }
 
@@ -116,9 +124,9 @@ static bool LoadHDR(QDataStream &s, const int width, const int height, QImage &i
         }
 
         if (val != 2) {
-            s.device()->at(s.device()->at() - 1);
-            Read_Old_Line(image.data(), width, s);
-            RGBE_To_QRgbLine(image.data(), scanline, width);
+            s.device()->ungetChar(val);
+            Read_Old_Line(image, width, s);
+            RGBE_To_QRgbLine(image, scanline, width);
             continue;
         }
 
@@ -132,12 +140,13 @@ static bool LoadHDR(QDataStream &s, const int width, const int height, QImage &i
 
         if ((image[1] != 2) || (image[2] & 128)) {
             image[0] = 2;
-            Read_Old_Line(image.data() + 4, width - 1, s);
-            RGBE_To_QRgbLine(image.data(), scanline, width);
+            Read_Old_Line(image + 4, width - 1, s);
+            RGBE_To_QRgbLine(image, scanline, width);
             continue;
         }
 
         if ((image[2] << 8 | image[3]) != width) {
+            qCDebug(HDRPLUGIN) << "Line of pixels had width" << (image[2] << 8 | image[3]) << "instead of" << width;
             return false;
         }
 
@@ -146,6 +155,7 @@ static bool LoadHDR(QDataStream &s, const int width, const int height, QImage &i
             for (int j = 0; j < width;) {
                 s >> code;
                 if (s.atEnd()) {
+                    qCDebug(HDRPLUGIN) << "Truncated HDR file";
                     return false;
                 }
                 if (code > 128) {
@@ -168,7 +178,7 @@ static bool LoadHDR(QDataStream &s, const int width, const int height, QImage &i
             }
         }
 
-        RGBE_To_QRgbLine(image.data(), scanline, width);
+        RGBE_To_QRgbLine(image, scanline, width);
     }
 
     return true;
@@ -176,63 +186,110 @@ static bool LoadHDR(QDataStream &s, const int width, const int height, QImage &i
 
 } // namespace
 
-Q_DECL_EXPORT void kimgio_hdr_read(QImageIO *io)
+bool HDRHandler::read(QImage *outImage)
 {
     int len;
-    char line[MAXLINE];
-    //bool validHeader = false;
-    bool validFormat = false;
+    QByteArray line(MAXLINE + 1, Qt::Uninitialized);
+    QByteArray format;
 
     // Parse header
     do {
-        len = io->ioDevice()->readLine(line, MAXLINE);
+        len = device()->readLine(line.data(), MAXLINE);
 
-        /*if (strcmp(line, "#?RADIANCE\n") == 0 || strcmp(line, "#?RGBE\n") == 0)
-        {
-            validHeader = true;
-        }*/
-        if (strcmp(line, "FORMAT=32-bit_rle_rgbe\n") == 0) {
-            validFormat = true;
+        if (line.startsWith("FORMAT=")) {
+            format = line.mid(7, len - 7 - 1 /*\n*/);
         }
 
     } while ((len > 0) && (line[0] != '\n'));
 
-    if (/*!validHeader ||*/ !validFormat) {
-        // qDebug() << "Unknown HDR format.";
-        io->setImage(0);
-        io->setStatus(-1);
-        return;
+    if (format != "32-bit_rle_rgbe") {
+        qCDebug(HDRPLUGIN) << "Unknown HDR format:" << format;
+        return false;
     }
 
-    io->ioDevice()->readLine(line, MAXLINE);
+    len = device()->readLine(line.data(), MAXLINE);
+    line.resize(len);
 
-    char s1[3], s2[3];
-    int width, height;
-    if (sscanf(line, "%2[+-XY] %d %2[+-XY] %d\n", s1, &height, s2, &width) != 4)
-        //if( sscanf(line, "-Y %d +X %d", &height, &width) < 2 )
-    {
-        // qDebug() << "Invalid HDR file.";
-        io->setImage(0);
-        io->setStatus(-1);
-        return;
+    /*
+       TODO: handle flipping and rotation, as per the spec below
+       The single resolution line consists of 4 values, a X and Y label each followed by a numerical
+       integer value. The X and Y are immediately preceded by a sign which can be used to indicate
+       flipping, the order of the X and Y indicate rotation. The standard coordinate system for
+       Radiance images would have the following resolution string -Y N +X N. This indicates that the
+       vertical axis runs down the file and the X axis is to the right (imagining the image as a
+       rectangular block of data). A -X would indicate a horizontal flip of the image. A +Y would
+       indicate a vertical flip. If the X value appears before the Y value then that indicates that
+       the image is stored in column order rather than row order, that is, it is rotated by 90 degrees.
+       The reader can convince themselves that the 8 combinations cover all the possible image orientations
+       and rotations.
+    */
+    QRegularExpression resolutionRegExp(QStringLiteral("([+\\-][XY]) ([0-9]+) ([+\\-][XY]) ([0-9]+)\n"));
+    QRegularExpressionMatch match = resolutionRegExp.match(QString::fromLatin1(line));
+    if (!match.hasMatch()) {
+        qCDebug(HDRPLUGIN) << "Invalid HDR file, the first line after the header didn't have the expected format:" << line;
+        return false;
     }
+    const int width = match.captured(2).toInt();
+    const int height = match.captured(4).toInt();
 
-    QDataStream s(io->ioDevice());
+    QDataStream s(device());
 
     QImage img;
     if (!LoadHDR(s, width, height, img)) {
         // qDebug() << "Error loading HDR file.";
-        io->setImage(0);
-        io->setStatus(-1);
-        return;
+        return false;
     }
 
-    io->setImage(img);
-    io->setStatus(0);
+    *outImage = img;
+    return true;
 }
 
-Q_DECL_EXPORT void kimgio_hdr_write(QImageIO *)
+HDRHandler::HDRHandler()
 {
-    // intentionally not implemented (since writing low dynamic range data to a HDR file is nonsense.)
 }
 
+bool HDRHandler::canRead() const
+{
+    if (canRead(device())) {
+        setFormat("hdr");
+        return true;
+    }
+    return false;
+}
+
+bool HDRHandler::canRead(QIODevice *device)
+{
+    if (!device) {
+        qWarning("HDRHandler::canRead() called with no device");
+        return false;
+    }
+
+    return device->peek(11) == "#?RADIANCE\n" || device->peek(7) == "#?RGBE\n";
+}
+
+QImageIOPlugin::Capabilities HDRPlugin::capabilities(QIODevice *device, const QByteArray &format) const
+{
+    if (format == "hdr") {
+        return Capabilities(CanRead);
+    }
+    if (!format.isEmpty()) {
+        return {};
+    }
+    if (!device->isOpen()) {
+        return {};
+    }
+
+    Capabilities cap;
+    if (device->isReadable() && HDRHandler::canRead(device)) {
+        cap |= CanRead;
+    }
+    return cap;
+}
+
+QImageIOHandler *HDRPlugin::create(QIODevice *device, const QByteArray &format) const
+{
+    QImageIOHandler *handler = new HDRHandler;
+    handler->setDevice(device);
+    handler->setFormat(format);
+    return handler;
+}

src/imageformats/hdr.json

@@ -0,0 +1,4 @@
+{
+    "Keys": [ "hdr" ],
+    "MimeTypes": [ "image/x-hdr", "image/vnd.radiance" ]
+}

src/imageformats/hdr_p.h

@@ -10,12 +10,27 @@
 #ifndef KIMG_HDR_P_H
 #define KIMG_HDR_P_H
 
-class QImageIO;
+#include <QImageIOPlugin>
 
-extern "C" {
-    void kimgio_hdr_read(QImageIO *);
-    void kimgio_hdr_write(QImageIO *);
-}
+class HDRHandler : public QImageIOHandler
+{
+public:
+    HDRHandler();
 
-#endif
+    bool canRead() const override;
+    bool read(QImage *outImage) override;
 
+    static bool canRead(QIODevice *device);
+};
+
+class HDRPlugin : public QImageIOPlugin
+{
+    Q_OBJECT
+    Q_PLUGIN_METADATA(IID "org.qt-project.Qt.QImageIOHandlerFactoryInterface" FILE "hdr.json")
+
+public:
+    Capabilities capabilities(QIODevice *device, const QByteArray &format) const override;
+    QImageIOHandler *create(QIODevice *device, const QByteArray &format = QByteArray()) const override;
+};
+
+#endif // KIMG_HDR_P_H

src/imageformats/kra.cpp

@@ -18,6 +18,9 @@
 #include <QIODevice>
 #include <QFile>
 
+static constexpr char s_magic[] = "application/x-krita";
+static constexpr int s_magic_size = sizeof(s_magic) - 1; // -1 to remove the last \0
+
 KraHandler::KraHandler()
 {
 }
@@ -36,7 +39,7 @@ bool KraHandler::read(QImage *image)
     KZip zip(device());
     if (!zip.open(QIODevice::ReadOnly)) return false;
 
-    const KArchiveEntry *entry = zip.directory()->entry(QLatin1String("mergedimage.png"));
+    const KArchiveEntry *entry = zip.directory()->entry(QStringLiteral("mergedimage.png"));
     if (!entry || !entry->isFile()) return false;
 
     const KZipFileEntry* fileZipEntry = static_cast<const KZipFileEntry*>(entry);
@@ -55,7 +58,7 @@ bool KraHandler::canRead(QIODevice *device)
 
     char buff[57];
     if (device->peek(buff, sizeof(buff)) == sizeof(buff))
-        return qstrcmp(buff + 0x26, "application/x-krita") == 0;
+        return memcmp(buff + 0x26, s_magic, s_magic_size) == 0;
 
     return false;
 }

src/imageformats/ora.cpp

@@ -17,6 +17,9 @@
 
 #include <kzip.h>
 
+static constexpr char s_magic[] = "image/openraster";
+static constexpr int s_magic_size = sizeof(s_magic) - 1; // -1 to remove the last \0
+
 OraHandler::OraHandler()
 {
 }
@@ -35,7 +38,7 @@ bool OraHandler::read(QImage *image)
     KZip zip(device());
     if (!zip.open(QIODevice::ReadOnly)) return false;
 
-    const KArchiveEntry *entry = zip.directory()->entry(QLatin1String("mergedimage.png"));
+    const KArchiveEntry *entry = zip.directory()->entry(QStringLiteral("mergedimage.png"));
     if (!entry || !entry->isFile()) return false;
 
     const KZipFileEntry* fileZipEntry = static_cast<const KZipFileEntry*>(entry);
@@ -54,7 +57,7 @@ bool OraHandler::canRead(QIODevice *device)
 
     char buff[54];
     if (device->peek(buff, sizeof(buff)) == sizeof(buff))
-        return qstrcmp(buff + 0x26, "image/openraster") == 0;
+        return memcmp(buff + 0x26, s_magic, s_magic_size) == 0;
 
     return false;
 }

src/imageformats/pcx.cpp

@@ -23,7 +23,7 @@ public:
     quint8 g;
     quint8 b;
 
-    static RGB from(const QRgb &color)
+    static RGB from(const QRgb color)
     {
         RGB c;
         c.r = qRed(color);
@@ -169,7 +169,7 @@ static QDataStream &operator>>(QDataStream &s, PCXHEADER &ph)
     return s;
 }
 
-static QDataStream &operator<<(QDataStream &s, const RGB &rgb)
+static QDataStream &operator<<(QDataStream &s, const RGB rgb)
 {
     s << rgb.r << rgb.g << rgb.b;
 
@@ -253,8 +253,10 @@ static void readImage1(QImage &img, QDataStream &s, const PCXHEADER &header)
     img = QImage(header.width(), header.height(), QImage::Format_Mono);
     img.setColorCount(2);
 
-    if (img.isNull())
+    if (img.isNull()) {
+        qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(header.width(), header.height());
         return;
+    }
 
     for (int y = 0; y < header.height(); ++y) {
         if (s.atEnd()) {
@@ -282,6 +284,10 @@ static void readImage4(QImage &img, QDataStream &s, const PCXHEADER &header)
 
     img = QImage(header.width(), header.height(), QImage::Format_Indexed8);
     img.setColorCount(16);
+    if (img.isNull()) {
+        qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(header.width(), header.height());
+        return;
+    }
 
     for (int y = 0; y < header.height(); ++y) {
         if (s.atEnd()) {
@@ -301,6 +307,9 @@ static void readImage4(QImage &img, QDataStream &s, const PCXHEADER &header)
         }
 
         uchar *p = img.scanLine(y);
+        if (!p) {
+            qWarning() << "Failed to get scanline for" << y << "might be out of bounds";
+        }
         for (int x = 0; x < header.width(); ++x) {
             p[ x ] = pixbuf[ x ];
         }
@@ -319,6 +328,11 @@ static void readImage8(QImage &img, QDataStream &s, const PCXHEADER &header)
     img = QImage(header.width(), header.height(), QImage::Format_Indexed8);
     img.setColorCount(256);
 
+    if (img.isNull()) {
+        qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(header.width(), header.height());
+        return;
+    }
+
     for (int y = 0; y < header.height(); ++y) {
         if (s.atEnd()) {
             img = QImage();
@@ -360,6 +374,11 @@ static void readImage24(QImage &img, QDataStream &s, const PCXHEADER &header)
 
     img = QImage(header.width(), header.height(), QImage::Format_RGB32);
 
+    if (img.isNull()) {
+        qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(header.width(), header.height());
+        return;
+    }
+
     for (int y = 0; y < header.height(); ++y) {
         if (s.atEnd()) {
             img = QImage();

src/imageformats/pic.cpp

@@ -130,9 +130,7 @@ static QDataStream &operator>> (QDataStream &s, QList<PicChannel> &channels)
         PicChannel channel;
         s >> chained;
         s >> channel.size;
-        quint8 encoding;
-        s >> encoding;
-        channel.encoding = PicChannelEncoding(encoding);
+        s >> channel.encoding;
         s >> channel.code;
         channels << channel;
         ++count;
@@ -255,6 +253,11 @@ bool SoftimagePICHandler::read(QImage *image)
     }
 
     QImage img(m_header.width, m_header.height, fmt);
+    if (img.isNull()) {
+        qDebug() << "Failed to allocate image, invalid dimensions?" << QSize(m_header.width, m_header.height) << fmt;
+        return false;
+    }
+
     img.fill(qRgb(0,0,0));
 
     for (int y = 0; y < m_header.height; y++) {
@@ -364,6 +367,7 @@ bool SoftimagePICHandler::readHeader()
             m_state = ReadHeader;
         }
     }
+
     return m_state != Error;
 }
 

src/imageformats/pic_p.h

@@ -119,7 +119,7 @@ struct PicHeader {
  */
 struct PicChannel {
     quint8 size; /**< Bits per component per pixel. */
-    PicChannelEncoding encoding; /**< How the channel's data is encoded. */
+    quint8 encoding; /**< How the channel's data is encoded. */
     quint8 code; /**< Flag field to describe which components are encoded in
                       this channel. */
 

src/imageformats/pnm.desktop

@@ -1,7 +0,0 @@
-[Desktop Entry]
-Type=Service
-X-KDE-ServiceTypes=QImageIOPlugins
-X-KDE-ImageFormat=pnm
-X-KDE-MimeType=image/x-portable-anymap
-X-KDE-Read=true
-X-KDE-Write=false

src/imageformats/psd.cpp

@@ -171,10 +171,20 @@ static bool LoadPSD(QDataStream &stream, const PSDHeader &header, QImage &img)
         channel_num = 4;
     }
     img = QImage(header.width, header.height, fmt);
+    if (img.isNull()) {
+        qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(header.width, header.height);
+        return false;
+    }
     img.fill(qRgb(0,0,0));
 
     const quint32 pixel_count = header.height * header.width;
 
+    // Verify this, as this is used to write into the memory of the QImage
+    if (pixel_count > img.sizeInBytes() / sizeof(QRgb)) {
+        qWarning() << "Invalid pixel count!" << pixel_count << "bytes available:" << img.sizeInBytes();
+        return false;
+    }
+
     QRgb *image_data = reinterpret_cast<QRgb*>(img.bits());
 
     if (!image_data) {
@@ -276,6 +286,11 @@ bool PSDHandler::canRead(QIODevice *device)
 
     char head[4];
     qint64 readBytes = device->read(head, sizeof(head));
+    if (readBytes < 0) {
+        qWarning() << "Read failed" << device->errorString();
+        return false;
+    }
+
     if (readBytes != sizeof(head)) {
         if (device->isSequential()) {
             while (readBytes > 0) {

src/imageformats/ras.cpp

@@ -143,7 +143,7 @@ static bool LoadRAS(QDataStream &s, const RasHeader &ras, QImage &img)
     QVector<quint8> input(ras.Length);
 
     int i = 0;
-    while (! s.atEnd()) {
+    while (! s.atEnd() && i < input.size()) {
         s >> input[i];
         // I guess we need to find out if we're at the end of a line
         if (paddingrequired && i != 0 && !(i % (ras.Width * bpp))) {

src/imageformats/rgb.cpp

@@ -313,6 +313,10 @@ bool SGIImage::readImage(QImage &img)
     }
 
     img = QImage(_xsize, _ysize, QImage::Format_RGB32);
+    if (img.isNull()) {
+        qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(_xsize, _ysize);
+        return false;
+    }
 
     if (_zsize == 0 )
         return false;
@@ -336,6 +340,9 @@ bool SGIImage::readImage(QImage &img)
             _stream >> _starttab[l];
             _starttab[l] -= 512 + _numrows * 2 * sizeof(quint32);
         }
+        for (; l < _numrows; l++) {
+            _starttab[l] = 0;
+        }
 
         _lengthtab = new quint32[_numrows];
         for (l = 0; l < _numrows; l++) {
@@ -467,7 +474,14 @@ bool SGIImage::scanData(const QImage &img)
     uint len;
 
     for (y = 0; y < _ysize; y++) {
-        c = reinterpret_cast<const QRgb *>(img.scanLine(_ysize - y - 1));
+        const int yPos = _ysize - y - 1; // scanline doesn't do any sanity checking
+        if (yPos >= img.height()) {
+            qWarning() << "Failed to get scanline for" << yPos;
+            return false;
+        }
+
+        c = reinterpret_cast<const QRgb *>(img.scanLine(yPos));
+
         for (x = 0; x < _xsize; x++) {
             buf[x] = intensity(qRed(*c++));
         }
@@ -481,7 +495,13 @@ bool SGIImage::scanData(const QImage &img)
 
     if (_zsize != 2) {
         for (y = 0; y < _ysize; y++) {
-            c = reinterpret_cast<const QRgb *>(img.scanLine(_ysize - y - 1));
+            const int yPos = _ysize - y - 1;
+            if (yPos >= img.height()) {
+                qWarning() << "Failed to get scanline for" << yPos;
+                return false;
+            }
+
+            c = reinterpret_cast<const QRgb *>(img.scanLine(yPos));
             for (x = 0; x < _xsize; x++) {
                 buf[x] = intensity(qGreen(*c++));
             }
@@ -490,7 +510,13 @@ bool SGIImage::scanData(const QImage &img)
         }
 
         for (y = 0; y < _ysize; y++) {
-            c = reinterpret_cast<const QRgb *>(img.scanLine(_ysize - y - 1));
+            const int yPos = _ysize - y - 1;
+            if (yPos >= img.height()) {
+                qWarning() << "Failed to get scanline for" << yPos;
+                return false;
+            }
+
+            c = reinterpret_cast<const QRgb *>(img.scanLine(yPos));
             for (x = 0; x < _xsize; x++) {
                 buf[x] = intensity(qBlue(*c++));
             }
@@ -504,7 +530,13 @@ bool SGIImage::scanData(const QImage &img)
     }
 
     for (y = 0; y < _ysize; y++) {
-        c = reinterpret_cast<const QRgb *>(img.scanLine(_ysize - y - 1));
+        const int yPos = _ysize - y - 1;
+        if (yPos >= img.height()) {
+            qWarning() << "Failed to get scanline for" << yPos;
+            return false;
+        }
+
+        c = reinterpret_cast<const QRgb *>(img.scanLine(yPos));
         for (x = 0; x < _xsize; x++) {
             buf[x] = intensity(qAlpha(*c++));
         }
@@ -709,7 +741,7 @@ bool RGBHandler::canRead(QIODevice *device)
         device->seek(oldPos);
     }
 
-    return head.size() >= 4 && head.startsWith("\x01\xda\x01") && (head[3] == 1 || head[3] == 2);
+    return head.size() >= 4 && head.startsWith("\x01\xda") && (head[2] == 0 || head[2] == 1) && (head[3] == 1 || head[3] == 2);
 }
 
 ///////////////////////////////////////////////////////////////////////////////

src/imageformats/tga.cpp

@@ -178,6 +178,10 @@ static bool LoadTGA(QDataStream &s, const TgaHeader &tga, QImage &img)
 {
     // Create image.
     img = QImage(tga.width, tga.height, QImage::Format_RGB32);
+    if (img.isNull()) {
+        qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(tga.width, tga.height);
+        return false;
+    }
 
     TgaHeaderInfo info(tga);
 
@@ -186,6 +190,10 @@ static bool LoadTGA(QDataStream &s, const TgaHeader &tga, QImage &img)
     // However alpha exists only in the 32 bit format.
     if ((tga.pixel_size == 32) && (tga.flags & 0xf)) {
         img = QImage(tga.width, tga.height, QImage::Format_ARGB32);
+        if (img.isNull()) {
+            qWarning() << "Failed to allocate image, invalid dimensions?" << QSize(tga.width, tga.height);
+            return false;
+        }
 
         if (numAlphaBits > 8) {
             return false;
@@ -201,16 +209,20 @@ static bool LoadTGA(QDataStream &s, const TgaHeader &tga, QImage &img)
     }
 
     // Read palette.
-    char palette[768];
+    static const int max_palette_size = 768;
+    char palette[max_palette_size];
     if (info.pal) {
         // @todo Support palettes in other formats!
-        const int size = 3 * tga.colormap_length;
-        const int dataRead = s.readRawData(palette, size);
+        const int palette_size = 3 * tga.colormap_length;
+        if (palette_size > max_palette_size) {
+            return false;
+        }
+        const int dataRead = s.readRawData(palette, palette_size);
         if (dataRead < 0) {
             return false;
         }
-        if (dataRead < size) {
-            memset(&palette[dataRead], 0, size - dataRead);
+        if (dataRead < max_palette_size) {
+            memset(&palette[dataRead], 0, max_palette_size - dataRead);
         }
     }
 
@@ -225,9 +237,10 @@ static bool LoadTGA(QDataStream &s, const TgaHeader &tga, QImage &img)
     if (info.rle) {
         // Decode image.
         char *dst = (char *)image;
+        char *imgEnd = dst + size;
         qint64 num = size;
 
-        while (num > 0) {
+        while (num > 0 && valid) {
             if (s.atEnd()) {
                 valid = false;
                 break;
@@ -248,15 +261,40 @@ static bool LoadTGA(QDataStream &s, const TgaHeader &tga, QImage &img)
                 // RLE pixels.
                 assert(pixel_size <= 8);
                 char pixel[8];
-                s.readRawData(pixel, pixel_size);
+                const int dataRead = s.readRawData(pixel, pixel_size);
+                if (dataRead < (int)pixel_size) {
+                    memset(&pixel[dataRead], 0, pixel_size - dataRead);
+                }
                 do {
+                    if (dst + pixel_size > imgEnd) {
+                        qWarning() << "Trying to write out of bounds!" << ptrdiff_t(dst) << (ptrdiff_t(imgEnd) - ptrdiff_t(pixel_size));
+                        valid = false;
+                        break;
+                    }
+
                     memcpy(dst, pixel, pixel_size);
                     dst += pixel_size;
                 } while (--count);
             } else {
                 // Raw pixels.
                 count *= pixel_size;
-                s.readRawData(dst, count);
+                const int dataRead = s.readRawData(dst, count);
+                if (dataRead < 0) {
+                    free(image);
+                    return false;
+                }
+
+
+                if ((uint)dataRead < count) {
+                    const size_t toCopy = count - dataRead;
+                    if (&dst[dataRead] + toCopy > imgEnd) {
+                        qWarning() << "Trying to write out of bounds!" << ptrdiff_t(image) << ptrdiff_t(&dst[dataRead]);;
+                        valid = false;
+                        break;
+                    }
+
+                    memset(&dst[dataRead], 0, toCopy);
+                }
                 dst += count;
             }
         }

tests/imagedump.cpp

@@ -116,8 +116,8 @@ int main(int argc, char **argv)
         }
         img = img.convertToFormat(qformat);
     }
-    qint64 written = output.write(reinterpret_cast<const char *>(img.bits()), img.byteCount());
-    if (written != img.byteCount()) {
+    qint64 written = output.write(reinterpret_cast<const char *>(img.bits()), img.sizeInBytes());
+    if (written != img.sizeInBytes()) {
         QTextStream(stderr) << "Could not write image data to " << files.at(1)
                             << ":" << output.errorString() << "\n";
         return 5;