From e34b2243a54ce139688434c437fa89f4f31c8b5c Mon Sep 17 00:00:00 2001 From: Debian Qt/KDE Maintainers Date: Mon, 14 Sep 2020 14:56:35 +0100 Subject: [PATCH] fix buffer overflow in XBM parser Origin: upstream, https://code.qt.io/cgit/qt/qtbase.git/commit/?id=1616c71921b73b22 Last-Update: 2020-08-18 Gbp-Pq: Name CVE-2020-17507.patch --- src/gui/image/qxbmhandler.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/gui/image/qxbmhandler.cpp b/src/gui/image/qxbmhandler.cpp index 414e82331..2824480b5 100644 --- a/src/gui/image/qxbmhandler.cpp +++ b/src/gui/image/qxbmhandler.cpp @@ -154,7 +154,9 @@ static bool read_xbm_body(QIODevice *device, int w, int h, QImage *outImage) w = (w+7)/8; // byte width while (y < h) { // for all encoded bytes... - if (p) { // p = "0x.." + if (p && p < (buf + readBytes - 3)) { // p = "0x.." + if (!isxdigit(p[2]) || !isxdigit(p[3])) + return false; *b++ = hex2byte(p+2); p += 2; if (++x == w && ++y < h) { -- 2.30.2