Skip to content

Commit e50aa22

Browse files
committed
Fix a division by zero when processing malformed BMP files.
This fixes a division by 0 when processing a maliciously crafted BMP file. No impact beyond DoS. Backport of 661f6bfd032dacc62841037732816a583640e187 Task-number: QTBUG-44547 Change-Id: I43f06e752b11cb50669101460902a82b885ae618 Reviewed-by: Thiago Macieira <[email protected]>
1 parent 7296f65 commit e50aa22

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

src/gui/image/qbmphandler.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,10 +319,16 @@ static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, int offset, int
319319
}
320320
} else if (comp == BMP_BITFIELDS && (nbits == 16 || nbits == 32)) {
321321
red_shift = calc_shift(red_mask);
322+
if (((red_mask >> red_shift) + 1) == 0)
323+
return false;
322324
red_scale = 256 / ((red_mask >> red_shift) + 1);
323325
green_shift = calc_shift(green_mask);
326+
if (((green_mask >> green_shift) + 1) == 0)
327+
return false;
324328
green_scale = 256 / ((green_mask >> green_shift) + 1);
325329
blue_shift = calc_shift(blue_mask);
330+
if (((blue_mask >> blue_shift) + 1) == 0)
331+
return false;
326332
blue_scale = 256 / ((blue_mask >> blue_shift) + 1);
327333
} else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
328334
blue_mask = 0x000000ff;

0 commit comments

Comments
 (0)