Fix a division by zero when processing malformed BMP files.

This fixes a division by 0 when processing a maliciously crafted BMP file. No impact beyond DoS. Task-number: QTBUG-44547 Change-Id: Ifcded2c0aa712e90d23e6b3969af0ec3add53973 Reviewed-by: Thiago Macieira <[email protected]> Reviewed-by: Oswald Buddenhagen <[email protected]>
brad0 · Feb 24, 2015 · 661f6bf · 661f6bf
1 parent 1afe110
commit 661f6bf
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
@@ -314,12 +314,20 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
         }
     } else if (comp == BMP_BITFIELDS && (nbits == 16 || nbits == 32)) {
         red_shift = calc_shift(red_mask);
+        if (((red_mask >> red_shift) + 1) == 0)
+            return false;
         red_scale = 256 / ((red_mask >> red_shift) + 1);
         green_shift = calc_shift(green_mask);
+        if (((green_mask >> green_shift) + 1) == 0)
+            return false;
         green_scale = 256 / ((green_mask >> green_shift) + 1);
         blue_shift = calc_shift(blue_mask);
+        if (((blue_mask >> blue_shift) + 1) == 0)
+            return false;
         blue_scale = 256 / ((blue_mask >> blue_shift) + 1);
         alpha_shift = calc_shift(alpha_mask);
+        if (((alpha_mask >> alpha_shift) + 1) == 0)
+            return false;
         alpha_scale = 256 / ((alpha_mask >> alpha_shift) + 1);
     } else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
         blue_mask = 0x000000ff;