Details
-
Bug
-
Resolution: Done
-
P2: Important
-
4.8.0
-
None
-
3b7edefb5b8a3dd6b1b53af4039cf1a862cd0aed
Description
QMacPixmapData::copy copies image data with our ever checking of the resize operation was successful.
If the allocation fails (see https://bugreports.qt-project.org/browse/QTBUG-24710) this code is going to crash because dest is NULL.
resize(rect.width(), rect.height());
....
char *dest = reinterpret_cast<char*>(pixels);
const char *src = reinterpret_cast<const char*>(macData->pixels + x) + y * macData->bytesPerRow;
for (int i = 0; i < h; ++i) {
memcpy(dest, src, w * 4); // BOOM!
dest += bytesPerRow;
src += macData->bytesPerRow;
}