Attachment #100045 for bug #151838

Lines 171-177 Link Here

(-)//depot/qt/3/src/kernel/qfontengine_x11.cpp (-1 / +2 lines)
171		171
172	QRect br = xmat.mapRect(QRect(x, y - si->ascent, w, h));	172	QRect br = xmat.mapRect(QRect(x, y - si->ascent, w, h));
173	QRect br2 = br & pdevRect;	173	QRect br2 = br & pdevRect;
174	if (br2.width() <= 0 \|\| br2.height() <= 0)	174	if (br2.width() <= 0 \|\| br2.height() <= 0
		175	\|\| br2.width() >= 32768 \|\| br2.height() >= 32768)
175	return;	176	return;
176	QWMatrix mat = QPixmap::trueMatrix( xmat, w, h );	177	QWMatrix mat = QPixmap::trueMatrix( xmat, w, h );
177	QBitmap wx_bm = ::transform(dpy, bm, br2.x() - br.x(), br2.y() - br.y(), br2.width(), br2.height(), mat);	178	QBitmap wx_bm = ::transform(dpy, bm, br2.x() - br.x(), br2.y() - br.y(), br2.width(), br2.height(), mat);

Lines 475-481 Link Here

(-)//depot/qt/3/src/kernel/qimage.cpp (-5 / +14 lines)
475	Endian bitOrder )	475	Endian bitOrder )
476	{	476	{
477	init();	477	init();
478	if ( w <= 0 \|\| h <= 0 \|\| depth <= 0 \|\| numColors < 0 )	478	int bpl = ((wdepth+31)/32)4; // bytes per scanline
		479	if ( w <= 0 \|\| h <= 0 \|\| depth <= 0 \|\| numColors < 0
		480	\|\| INT_MAX / sizeof(uchar *) < uint(h)
		481	\|\| INT_MAX / uint(depth) < uint(w)
		482	\|\| bpl <= 0
		483	\|\| INT_MAX / uint(bpl) < uint(h) )
479	return; // invalid parameter(s)	484	return; // invalid parameter(s)
480	data->w = w;	485	data->w = w;
481	data->h = h;	486	data->h = h;
Lines 483-489 Link Here
483	data->ncols = depth != 32 ? numColors : 0;	488	data->ncols = depth != 32 ? numColors : 0;
484	if ( !yourdata )	489	if ( !yourdata )
485	return; // Image header info can be saved without needing to allocate memory.	490	return; // Image header info can be saved without needing to allocate memory.
486	int bpl = ((wdepth+31)/32)4; // bytes per scanline
487	data->nbytes = bpl*h;	491	data->nbytes = bpl*h;
488	if ( colortable \|\| !data->ncols ) {	492	if ( colortable \|\| !data->ncols ) {
489	data->ctbl = colortable;	493	data->ctbl = colortable;
Lines 525-531 Link Here
525	Endian bitOrder )	529	Endian bitOrder )
526	{	530	{
527	init();	531	init();
528	if ( !yourdata \|\| w <= 0 \|\| h <= 0 \|\| depth <= 0 \|\| numColors < 0 )	532	if ( !yourdata \|\| w <= 0 \|\| h <= 0 \|\| depth <= 0 \|\| numColors < 0
		533	\|\| INT_MAX / sizeof(uchar *) < uint(h)
		534	\|\| INT_MAX / uint(bpl) < uint(h)
		535	)
529	return; // invalid parameter(s)	536	return; // invalid parameter(s)
530	data->w = w;	537	data->w = w;
531	data->h = h;	538	data->h = h;
Lines 1264-1270 Link Here
1264	if ( data->ncols != numColors ) // could not alloc color table	1271	if ( data->ncols != numColors ) // could not alloc color table
1265	return FALSE;	1272	return FALSE;
1266		1273
1267	if ( INT_MAX / depth < width) { // sanity check for potential overflow	1274	if ( INT_MAX / uint(depth) < uint(width) ) { // sanity check for potential overflow
1268	setNumColors( 0 );	1275	setNumColors( 0 );
1269	return FALSE;	1276	return FALSE;
1270	}	1277	}
Lines 1277-1283 Link Here
1277	// #### WWA: shouldn't this be (width*depth+7)/8:	1284	// #### WWA: shouldn't this be (width*depth+7)/8:
1278	const int pad = bpl - (width*depth)/8; // pad with zeros	1285	const int pad = bpl - (width*depth)/8; // pad with zeros
1279	#endif	1286	#endif
1280	if (INT_MAX / bpl < height) { // sanity check for potential overflow	1287	if ( INT_MAX / uint(bpl) < uint(height)
		1288	\|\| bpl < 0
		1289	\|\| INT_MAX / sizeof(uchar *) < uint(height) ) { // sanity check for potential overflow
1281	setNumColors( 0 );	1290	setNumColors( 0 );
1282	return FALSE;	1291	return FALSE;
1283	}	1292	}

Lines 953-958 Link Here

(-)//depot/qt/3/src/kernel/qpixmap_x11.cpp (-9 / +18 lines)
953	bool force_mono = (dd == 1 \|\| isQBitmap() \|\|	953	bool force_mono = (dd == 1 \|\| isQBitmap() \|\|
954	(conversion_flags & ColorMode_Mask)==MonoOnly );	954	(conversion_flags & ColorMode_Mask)==MonoOnly );
955		955
		956	if ( w >= 32768 \|\| h >= 32768 )
		957	return FALSE;
		958
956	// get rid of the mask	959	// get rid of the mask
957	delete data->mask;	960	delete data->mask;
958	data->mask = 0;	961	data->mask = 0;
Lines 1678-1688 Link Here
1678		1681
1679	QPixmap QPixmap::xForm( const QWMatrix &matrix ) const	1682	QPixmap QPixmap::xForm( const QWMatrix &matrix ) const
1680	{	1683	{
1681	int w = 0;	1684	uint w = 0;
1682	int h = 0; // size of target pixmap	1685	uint h = 0; // size of target pixmap
1683	int ws, hs; // size of source pixmap	1686	uint ws, hs; // size of source pixmap
1684	uchar *dptr; // data in target pixmap	1687	uchar *dptr; // data in target pixmap
1685	int dbpl, dbytes; // bytes per line/bytes total	1688	uint dbpl, dbytes; // bytes per line/bytes total
1686	uchar *sptr; // data in original pixmap	1689	uchar *sptr; // data in original pixmap
1687	int sbpl; // bytes per line in original	1690	int sbpl; // bytes per line in original
1688	int bpp; // bits per pixel	1691	int bpp; // bits per pixel
Lines 1697-1715 Link Here
1697		1700
1698	QWMatrix mat( matrix.m11(), matrix.m12(), matrix.m21(), matrix.m22(), 0., 0. );	1701	QWMatrix mat( matrix.m11(), matrix.m12(), matrix.m21(), matrix.m22(), 0., 0. );
1699		1702
		1703	double scaledWidth;
		1704	double scaledHeight;
		1705
1700	if ( matrix.m12() == 0.0F && matrix.m21() == 0.0F ) {	1706	if ( matrix.m12() == 0.0F && matrix.m21() == 0.0F ) {
1701	if ( matrix.m11() == 1.0F && matrix.m22() == 1.0F )	1707	if ( matrix.m11() == 1.0F && matrix.m22() == 1.0F )
1702	return *this; // identity matrix	1708	return *this; // identity matrix
1703	h = qRound( matrix.m22()*hs );	1709	scaledHeight = matrix.m22()*hs;
1704	w = qRound( matrix.m11()*ws );	1710	scaledWidth = matrix.m11()*ws;
1705	h = QABS( h );	1711	h = QABS( qRound( scaledHeight ) );
1706	w = QABS( w );	1712	w = QABS( qRound( scaledWidth ) );
1707	} else { // rotation or shearing	1713	} else { // rotation or shearing
1708	QPointArray a( QRect(0,0,ws+1,hs+1) );	1714	QPointArray a( QRect(0,0,ws+1,hs+1) );
1709	a = mat.map( a );	1715	a = mat.map( a );
1710	QRect r = a.boundingRect().normalize();	1716	QRect r = a.boundingRect().normalize();
1711	w = r.width()-1;	1717	w = r.width()-1;
1712	h = r.height()-1;	1718	h = r.height()-1;
		1719	scaledWidth = w;
		1720	scaledHeight = h;
1713	}	1721	}
1714		1722
1715	mat = trueMatrix( mat, ws, hs ); // true matrix	1723	mat = trueMatrix( mat, ws, hs ); // true matrix
Lines 1718-1724 Link Here
1718	bool invertible;	1726	bool invertible;
1719	mat = mat.invert( &invertible ); // invert matrix	1727	mat = mat.invert( &invertible ); // invert matrix
1720		1728
1721	if ( h == 0 \|\| w == 0 \|\| !invertible ) { // error, return null pixmap	1729	if ( h == 0 \|\| w == 0 \|\| !invertible
		1730	\|\| QABS(scaledWidth) >= 32768 \|\| QABS(scaledHeight) >= 32768 ) { // error, return null pixmap
1722	QPixmap pm;	1731	QPixmap pm;
1723	pm.data->bitmap = data->bitmap;	1732	pm.data->bitmap = data->bitmap;
1724	return pm;	1733	return pm;

Return to bug 151838