qt5-qtbase/SOURCES/qt5-qtbase-CVE-2018-19870.patch

26 lines
1.4 KiB
Diff
Raw Normal View History

2019-11-05 18:48:40 +00:00
diff --git a/src/plugins/imageformats/gif/qgifhandler.cpp b/src/plugins/imageformats/gif/qgifhandler.cpp
index e0f7f44..ebe5964 100644
--- a/src/plugins/imageformats/gif/qgifhandler.cpp
+++ b/src/plugins/imageformats/gif/qgifhandler.cpp
@@ -354,7 +354,8 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
(*image) = QImage(swidth, sheight, format);
bpl = image->bytesPerLine();
bits = image->bits();
- memset(bits, 0, image->sizeInBytes());
+ if (bits)
+ memset(bits, 0, image->sizeInBytes());
}
// Check if the previous attempt to create the image failed. If it
@@ -415,6 +416,10 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
backingstore = QImage(qMax(backingstore.width(), w),
qMax(backingstore.height(), h),
QImage::Format_RGB32);
+ if (backingstore.isNull()) {
+ state = Error;
+ return -1;
+ }
memset(backingstore.bits(), 0, backingstore.sizeInBytes());
}
const int dest_bpl = backingstore.bytesPerLine();