Bugzilla – Attachment 22598 Details for
Bug 58356
VUL-0: CVE-2004-0691: qt: bmp parser overflow
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
patch from official qt 3.3.3 commercial edition for qimage.cpp. can you all review it for the BMP and XPM issues please ?
qimage.cpp.diff (text/plain), 2.82 KB, created by
Adrian Schröter
on 2004-08-06 22:17:23 UTC
(
hide
)
Description:
patch from official qt 3.3.3 commercial edition for qimage.cpp. can you all review it for the BMP and XPM issues please ?
Filename:
MIME Type:
Creator:
Adrian Schröter
Created:
2004-08-06 22:17:23 UTC
Size:
2.82 KB
patch
obsolete
>--- qt-x11-free-3.3.2/src/kernel/qimage.cpp 2004-04-19 11:36:05.000000000 +0200 >+++ qt-x11-commercial-3.3.3/src/kernel/qimage.cpp 2004-08-05 16:42:06.000000000 +0200 >@@ -1,5 +1,5 @@ > /**************************************************************************** >-** $Id: qt/qimage.cpp 3.3.2 edited Mar 29 14:59 $ >+** $Id: qt/qimage.cpp 3.3.3 edited Jul 28 14:16 $ > ** > ** Implementation of QImage and QImageIO classes > ** >@@ -730,6 +730,15 @@ > that->setAlphaBuffer( TRUE ); > } > image.setAlphaBuffer(hasAlphaBuffer()); >+ image.data->dpmx = dotsPerMeterX(); >+ image.data->dpmy = dotsPerMeterY(); >+ image.data->offset = offset(); >+#ifndef QT_NO_IMAGE_TEXT >+ if ( data->misc ) { >+ image.data->misc = new QImageDataMisc; >+ *image.data->misc = misc(); >+ } >+#endif > return image; > } > >@@ -4818,6 +4827,7 @@ > if ( comp == BMP_RLE8 ) { // run length compression > int x=0, y=0, b; > register uchar *p = line[h-1]; >+ const uchar *endp = line[h-1]+w; > while ( y < h ) { > if ( (b=d->getch()) == EOF ) > break; >@@ -4835,9 +4845,20 @@ > case 2: // delta (jump) > x += d->getch(); > y += d->getch(); >+ >+ // Protection >+ if ( (uint)x >= (uint)w ) >+ x = w-1; >+ if ( (uint)y >= (uint)h ) >+ y = h-1; >+ > p = line[h-y-1] + x; > break; > default: // absolute mode >+ // Protection >+ if ( p + b > endp ) >+ b = endp-p; >+ > if ( d->readBlock( (char *)p, b ) != b ) > return FALSE; > if ( (b & 1) == 1 ) >@@ -4846,6 +4867,10 @@ > p += b; > } > } else { // encoded mode >+ // Protection >+ if ( p + b > endp ) >+ b = endp-p; >+ > memset( p, d->getch(), b ); // repeat pixel > x += b; > p += b; >@@ -5641,6 +5666,21 @@ > } > > >+ >+static int nextColorSpec(const QCString & buf) >+{ >+ int i = buf.find(" c "); >+ if (i < 0) >+ i = buf.find(" g "); >+ if (i < 0) >+ i = buf.find(" g4 "); >+ if (i < 0) >+ i = buf.find(" m "); >+ if (i < 0) >+ i = buf.find(" s "); >+ return i; >+} >+ > // > // INTERNAL > // >@@ -5697,23 +5737,17 @@ > index = buf.left( cpp ); > buf = buf.mid( cpp ).simplifyWhiteSpace().lower(); > buf.prepend( " " ); >- i = buf.find( " c " ); >- if ( i < 0 ) >- i = buf.find( " g " ); >- if ( i < 0 ) >- i = buf.find( " g4 " ); >- if ( i < 0 ) >- i = buf.find( " m " ); >+ i = nextColorSpec(buf); > if ( i < 0 ) { > #if defined(QT_CHECK_RANGE) > qWarning( "QImage: XPM color specification is missing: %s", buf.data()); > #endif >- return; // no c/g/g4/m specification at all >+ return; // no c/g/g4/m/s specification at all > } > buf = buf.mid( i+3 ); > // Strip any other colorspec >- int end = buf.find(' ', 4); >- if ( end >= 0 ) >+ int end = nextColorSpec(buf); >+ if (end != -1) > buf.truncate(end); > buf = buf.stripWhiteSpace(); > if ( buf == "none" ) {
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
Attachments on
bug 58356
:
22441
|
22446
| 22598 |
22599
|
22674
|
22675
|
22680
|
22691
|
22692