From 037370371946300672869671ec844e3fc5cda06b Mon Sep 17 00:00:00 2001 From: Eirik Aavitsland Date: Fri, 24 Aug 2018 12:03:00 +0200 Subject: [PATCH] [PATCH] TGA handler: check for out of range image size Make the decoder fail early to avoid spending time and memory on attempting to decode a corrupt image file. Change-Id: Iac35e72de743f412a65d11c58fe7faa275dc4e41 Reviewed-by: Lars Knoll Gbp-Pq: Name CVE-2018-19871.patch --- src/plugins/imageformats/tga/qtgafile.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/plugins/imageformats/tga/qtgafile.cpp b/src/plugins/imageformats/tga/qtgafile.cpp index 205e60b69..f50e30e61 100644 --- a/src/plugins/imageformats/tga/qtgafile.cpp +++ b/src/plugins/imageformats/tga/qtgafile.cpp @@ -165,6 +165,12 @@ QTgaFile::QTgaFile(QIODevice *device) if (!validDepth) { mErrorMessage = QObject::tr("Image depth not valid"); + return; + } + if (quint64(width()) * quint64(height()) > (8192 * 8192)) + { + mErrorMessage = QObject::tr("Image size exceeds limit"); + return; } int fileBytes = mDevice->size(); if (!mDevice->seek(fileBytes - FooterSize)) @@ -237,6 +243,8 @@ QImage QTgaFile::readImage() unsigned char yCorner = desc & 0x20; // 0 = lower, 1 = upper QImage im(imageWidth, imageHeight, QImage::Format_ARGB32); + if (im.isNull()) + return QImage(); TgaReader *reader = 0; if (bitsPerPixel == 16) reader = new Tga16Reader(); -- 2.30.2