Skip to content

Draft: Introduce a settable allocation limit on image loading

This one might be controversial, but it is prerequisite for a qtimageformats security fix.

Motivation: https://github.com/nomacs/nomacs/issues/516

QTBUG: https://bugreports.qt.io/browse/QTBUG-85037

[1/3] Introduce a settable allocation limit on image loading

[ChangeLog][QtGui][QImageReader] Introduced a settable allocation
limit on image loading to limit resource usage from corrupt image
files.

Change-Id: Ibed7b0cac32798125a060e6db80b17ebc5e70759
Task-number: QTBUG-85037
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
(cherry picked from commit 5dea4fe956c452be5aae2c61dd0777fdf1efe5d0)

[2/3] QImageReader: check allocation limit for minimum 32 bpp

Also, as a driveby, add an environment variable so the limit can be
changed at runtime.

[ChangeLog][QtGui][QImageReader] When checking allocation limit during
image reading, the memory requirements are now calculated for a
minimum of 32 bits per pixel, since Qt will typically convert an image
to that depth when it is used in GUI. This means that the effective
allocation limit is significantly smaller when reading 1 bpp and 8 bpp
images.

Pick-to: 6.2 6.2.2
Change-Id: If1b204d413973b0975eea531e29c260fdcec931d
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit 8ce36938569841020daf9dc23e41438b06e0ee53)

[3/3] Image IO: increase the default allocation limit

Time passes, Moore's law is working.

As a drive-by, make the doc more informative.

Fixes: QTBUG-113637
Pick-to: 6.5
Change-Id: Ic388b8850ace02c429d4d8175d31db86912d3afe
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
(cherry picked from commit 2385d669231c8c3af3aab1ae31fa0e4c9f170f1e)

Merge request reports