diff -ur qt-x11-free-3.3.8b/src/kernel/qimage.cpp qt-x11-free-3.3.8b-CVE-2015-0295/src/kernel/qimage.cpp --- qt-x11-free-3.3.8b/src/kernel/qimage.cpp 2008-01-15 20:09:13.000000000 +0100 +++ qt-x11-free-3.3.8b-CVE-2015-0295/src/kernel/qimage.cpp 2015-02-28 04:59:11.000000000 +0100 @@ -4716,10 +4716,16 @@ if ( (Q_ULONG)d->readBlock( (char *)&blue_mask, sizeof(blue_mask) ) != sizeof(blue_mask) ) return FALSE; red_shift = calc_shift(red_mask); + if (((red_mask >> red_shift) + 1) == 0) + return FALSE; red_scale = 256 / ((red_mask >> red_shift) + 1); green_shift = calc_shift(green_mask); + if (((green_mask >> green_shift) + 1) == 0) + return FALSE; green_scale = 256 / ((green_mask >> green_shift) + 1); blue_shift = calc_shift(blue_mask); + if (((blue_mask >> blue_shift) + 1) == 0) + return FALSE; blue_scale = 256 / ((blue_mask >> blue_shift) + 1); } else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) { blue_mask = 0x000000ff;