TGA handler: check for out of range image size

Make the decoder fail early to avoid spending time and memory on
attempting to decode a corrupt image file.

Change-Id: Iac35e72de743f412a65d11c58fe7faa275dc4e41
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Gbp-Pq: Name CVE-2018-19871.patch

diff --git a/src/plugins/imageformats/tga/qtgafile.cpp b/src/plugins/imageformats/tga/qtgafile.cpp
index 205e60b6984d7716643eaa72a362eae862cec405..f50e30e61a20728671e09b07f80d4504fc0f20cb 100644 (file)
--- a/src/plugins/imageformats/tga/qtgafile.cpp
+++ b/src/plugins/imageformats/tga/qtgafile.cpp
@@ -165,6 +165,12 @@ QTgaFile::QTgaFile(QIODevice *device)
     if (!validDepth)
     {
         mErrorMessage = QObject::tr("Image depth not valid");
+        return;
+    }
+    if (quint64(width()) * quint64(height()) > (8192 * 8192))
+    {
+        mErrorMessage = QObject::tr("Image size exceeds limit");
+        return;
     }
     int fileBytes = mDevice->size();
     if (!mDevice->seek(fileBytes - FooterSize))
@@ -237,6 +243,8 @@ QImage QTgaFile::readImage()
     unsigned char yCorner = desc & 0x20; // 0 = lower, 1 = upper
 
     QImage im(imageWidth, imageHeight, QImage::Format_ARGB32);
+    if (im.isNull())
+        return QImage();
     TgaReader *reader = 0;
     if (bitsPerPixel == 16)
         reader = new Tga16Reader();