Blob Blame History Raw
diff -ur qt-x11-free-3.3.8b/src/kernel/qimage.cpp qt-x11-free-3.3.8b-CVE-2015-0295/src/kernel/qimage.cpp
--- qt-x11-free-3.3.8b/src/kernel/qimage.cpp	2008-01-15 20:09:13.000000000 +0100
+++ qt-x11-free-3.3.8b-CVE-2015-0295/src/kernel/qimage.cpp	2015-02-28 04:59:11.000000000 +0100
@@ -4716,10 +4716,16 @@
 	if ( (Q_ULONG)d->readBlock( (char *)&blue_mask, sizeof(blue_mask) ) != sizeof(blue_mask) )
 	    return FALSE;
 	red_shift = calc_shift(red_mask);
+	if (((red_mask >> red_shift) + 1) == 0)
+	    return FALSE;
 	red_scale = 256 / ((red_mask >> red_shift) + 1);
 	green_shift = calc_shift(green_mask);
+	if (((green_mask >> green_shift) + 1) == 0)
+	    return FALSE;
 	green_scale = 256 / ((green_mask >> green_shift) + 1);
 	blue_shift = calc_shift(blue_mask);
+	if (((blue_mask >> blue_shift) + 1) == 0)
+	    return FALSE;
 	blue_scale = 256 / ((blue_mask >> blue_shift) + 1);
     } else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
 	blue_mask = 0x000000ff;