[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-commits
Subject:    kdelibs/kimgio
From:       Dirk Mueller <mueller () kde ! org>
Date:       2005-04-15 0:38:31
Message-ID: 20050415003831.A81F4492 () office ! kde ! org
[Download RAW message or body]

CVS commit by mueller: 

improved handling of malformed input


  M +7 -5      rgb.cpp   1.32


--- kdelibs/kimgio/rgb.cpp  #1.31:1.32
@@ -88,5 +88,7 @@ bool SGIImage::getRow(uchar *dest)
         if (!m_rle) {
                 for (i = 0; i < m_xsize; i++) {
-                        *dest++ = uchar(*m_pos);
+                        if(m_pos >= m_data.end())
+                                return false;
+                        dest[i] = uchar(*m_pos);
                         m_pos += m_bpc;
                 }
@@ -121,5 +123,5 @@ bool SGIImage::readData(QImage& img)
         QRgb *c;
         Q_UINT32 *start = m_starttab;
-        QCString lguard(m_xsize);
+        QByteArray lguard(m_xsize);
         uchar *line = (uchar *)lguard.data();
         unsigned x, y;
@@ -129,5 +131,5 @@ bool SGIImage::readData(QImage& img)
 
         for (y = 0; y < m_ysize; y++) {
-                c = reinterpret_cast<QRgb *>(img.scanLine(m_ysize - y - 1));
+                c = (QRgb *) img.scanLine(m_ysize - y - 1);
                 if (m_rle)
                         m_pos = m_data.begin() + *start++;
@@ -167,9 +169,9 @@ bool SGIImage::readData(QImage& img)
 
         for (y = 0; y < m_ysize; y++) {
-                c = reinterpret_cast<QRgb *>(img.scanLine(m_ysize - y - 1));
                 if (m_rle)
                         m_pos = m_data.begin() + *start++;
                 if (!getRow(line))
                         return false;
+                c = (QRgb*) img.scanLine(m_ysize - y - 1);
                 for (x = 0; x < m_xsize; x++, c++)
                         *c = qRgba(qRed(*c), qGreen(*c), qBlue(*c), line[x]);
@@ -271,5 +273,5 @@ bool SGIImage::readImage(QImage& img)
         if (m_rle)
                 for (uint o = 0; o < m_numrows; o++)
-                        if (m_starttab[o] + m_lengthtab[o] > m_data.size()) {
+                        if (m_starttab[o] + m_lengthtab[o] >= m_data.size()) {
                                 kdDebug(399) << "image corrupt (sanity check failed)" << endl;
                                 return false;


[prev in list] [next in list] [prev in thread] [next in thread]