summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSlávek Banko <slavek.banko@axis.cz>2015-03-09 22:35:08 +0100
committerSlávek Banko <slavek.banko@axis.cz>2015-03-09 22:35:08 +0100
commit64d9c07d5709e9bcb0b676d55c4a5b303599f708 (patch)
treeae5159a6b1465edcddca45107c29360df8410423
parentebf9a9871a1424469c6850d1844b1487e32d137a (diff)
downloadtqt3-64d9c07d.tar.gz
tqt3-64d9c07d.zip
Fix security issue CVE-2015-0295
[taken from RedHat Qt3 patches]
-rw-r--r--src/kernel/qimage.cpp6
1 files changed, 6 insertions, 0 deletions
diff --git a/src/kernel/qimage.cpp b/src/kernel/qimage.cpp
index a22b744a..ab42e188 100644
--- a/src/kernel/qimage.cpp
+++ b/src/kernel/qimage.cpp
@@ -4716,10 +4716,16 @@ bool read_dib( TQDataStream& s, int offset, int startpos, TQImage& image )
if ( (TQ_ULONG)d->readBlock( (char *)&blue_mask, sizeof(blue_mask) ) != sizeof(blue_mask) )
return FALSE;
red_shift = calc_shift(red_mask);
+ if (((red_mask >> red_shift) + 1) == 0)
+ return FALSE;
red_scale = 256 / ((red_mask >> red_shift) + 1);
green_shift = calc_shift(green_mask);
+ if (((green_mask >> green_shift) + 1) == 0)
+ return FALSE;
green_scale = 256 / ((green_mask >> green_shift) + 1);
blue_shift = calc_shift(blue_mask);
+ if (((blue_mask >> blue_shift) + 1) == 0)
+ return FALSE;
blue_scale = 256 / ((blue_mask >> blue_shift) + 1);
} else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
blue_mask = 0x000000ff;