cppcheck/test/bug-hunting/cve/CVE-2018-19872/qppmhandler.cpp

580 lines
18 KiB
C++

/****************************************************************************
**
** Copyright (C) 2016 The Qt Company Ltd.
** Contact: https://www.qt.io/licensing/
**
** This file is part of the QtGui module of the Qt Toolkit.
**
** $QT_BEGIN_LICENSE:LGPL$
** Commercial License Usage
** Licensees holding valid commercial Qt licenses may use this file in
** accordance with the commercial license agreement provided with the
** Software or, alternatively, in accordance with the terms contained in
** a written agreement between you and The Qt Company. For licensing terms
** and conditions see https://www.qt.io/terms-conditions. For further
** information use the contact form at https://www.qt.io/contact-us.
**
** GNU Lesser General Public License Usage
** Alternatively, this file may be used under the terms of the GNU Lesser
** General Public License version 3 as published by the Free Software
** Foundation and appearing in the file LICENSE.LGPL3 included in the
** packaging of this file. Please review the following information to
** ensure the GNU Lesser General Public License version 3 requirements
** will be met: https://www.gnu.org/licenses/lgpl-3.0.html.
**
** GNU General Public License Usage
** Alternatively, this file may be used under the terms of the GNU
** General Public License version 2.0 or (at your option) the GNU General
** Public license version 3 or any later version approved by the KDE Free
** Qt Foundation. The licenses are as published by the Free Software
** Foundation and appearing in the file LICENSE.GPL2 and LICENSE.GPL3
** included in the packaging of this file. Please review the following
** information to ensure the GNU General Public License requirements will
** be met: https://www.gnu.org/licenses/gpl-2.0.html and
** https://www.gnu.org/licenses/gpl-3.0.html.
**
** $QT_END_LICENSE$
**
****************************************************************************/
#include "private/qppmhandler_p.h"
#ifndef QT_NO_IMAGEFORMAT_PPM
#include <qimage.h>
#include <qvariant.h>
#include <qvector.h>
#include <ctype.h>
#include <qrgba64.h>
QT_BEGIN_NAMESPACE
/*****************************************************************************
PBM/PGM/PPM (ASCII and RAW) image read/write functions
*****************************************************************************/
static void discard_pbm_line(QIODevice *d)
{
const int buflen = 100;
char buf[buflen];
int res = 0;
do {
res = d->readLine(buf, buflen);
} while (res > 0 && buf[res-1] != '\n');
}
static int read_pbm_int(QIODevice *d)
{
char c;
int val = -1;
bool digit;
for (;;) {
if (!d->getChar(&c)) // end of file
break;
digit = isdigit((uchar) c);
if (val != -1) {
if (digit) {
val = 10*val + c - '0';
continue;
} else {
if (c == '#') // comment
discard_pbm_line(d);
break;
}
}
if (digit) // first digit
val = c - '0';
else if (isspace((uchar) c))
continue;
else if (c == '#')
discard_pbm_line(d);
else
break;
}
return val;
}
static bool read_pbm_header(QIODevice *device, char& type, int& w, int& h, int& mcc)
{
char buf[3];
if (device->read(buf, 3) != 3) // read P[1-6]<white-space>
return false;
if (!(buf[0] == 'P' && isdigit((uchar) buf[1]) && isspace((uchar) buf[2])))
return false;
type = buf[1];
if (type < '1' || type > '6')
return false;
w = read_pbm_int(device); // get image width
h = read_pbm_int(device); // get image height
if (type == '1' || type == '4')
mcc = 1; // ignore max color component
else
mcc = read_pbm_int(device); // get max color component
if (w <= 0 || w > 32767 || h <= 0 || h > 32767 || mcc <= 0)
return false; // weird P.M image
return true;
}
static inline QRgb scale_pbm_color(quint16 mx, quint16 rv, quint16 gv, quint16 bv)
{
return QRgba64::fromRgba64((rv * 0xffff) / mx, (gv * 0xffff) / mx, (bv * 0xffff) / mx, 0xffff).toArgb32();
}
static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, QImage *outImage)
{
int nbits, y;
int pbm_bpl;
bool raw;
QImage::Format format;
switch (type) {
case '1': // ascii PBM
case '4': // raw PBM
nbits = 1;
format = QImage::Format_Mono;
break;
case '2': // ascii PGM
case '5': // raw PGM
nbits = 8;
format = QImage::Format_Grayscale8;
break;
case '3': // ascii PPM
case '6': // raw PPM
nbits = 32;
format = QImage::Format_RGB32;
break;
default:
return false;
}
raw = type >= '4';
if (outImage->size() != QSize(w, h) || outImage->format() != format) {
*outImage = QImage(w, h, format);
if (outImage->isNull())
return false;
}
pbm_bpl = (nbits*w+7)/8; // bytes per scanline in PBM
if (raw) { // read raw data
if (nbits == 32) { // type 6
pbm_bpl = mcc < 256 ? 3*w : 6*w;
uchar *buf24 = new uchar[pbm_bpl], *b;
QRgb *p;
QRgb *end;
for (y=0; y<h; y++) {
if (device->read((char *)buf24, pbm_bpl) != pbm_bpl) {
delete[] buf24;
return false;
}
p = (QRgb *)outImage->scanLine(y);
end = p + w;
b = buf24;
while (p < end) {
if (mcc < 256) {
if (mcc == 255)
*p++ = qRgb(b[0],b[1],b[2]);
else
*p++ = scale_pbm_color(mcc, b[0], b[1], b[2]);
b += 3;
} else {
quint16 rv = b[0] << 8 | b[1];
quint16 gv = b[2] << 8 | b[3];
quint16 bv = b[4] << 8 | b[5];
if (mcc == 0xffff)
*p++ = QRgba64::fromRgba64(rv, gv, bv, 0xffff).toArgb32();
else
*p++ = scale_pbm_color(mcc, rv, gv, bv);
b += 6;
}
}
}
delete[] buf24;
} else if (nbits == 8 && mcc > 255) { // type 5 16bit
pbm_bpl = 2*w;
uchar *buf16 = new uchar[pbm_bpl];
for (y=0; y<h; y++) {
if (device->read((char *)buf16, pbm_bpl) != pbm_bpl) {
delete[] buf16;
return false;
}
uchar *p = outImage->scanLine(y);
uchar *end = p + w;
uchar *b = buf16;
while (p < end) {
*p++ = (b[0] << 8 | b[1]) * 255 / mcc;
b += 2;
}
}
delete[] buf16;
} else { // type 4,5
for (y=0; y<h; y++) {
uchar *p = outImage->scanLine(y);
if (device->read((char *)p, pbm_bpl) != pbm_bpl)
return false;
if (nbits == 8 && mcc < 255) {
for (int i = 0; i < pbm_bpl; i++)
p[i] = (p[i] * 255) / mcc;
}
}
}
} else { // read ascii data
uchar *p;
int n;
char buf;
for (y = 0; (y < h) && (device->peek(&buf, 1) == 1); y++) {
p = outImage->scanLine(y);
n = pbm_bpl;
if (nbits == 1) {
int b;
int bitsLeft = w;
while (n--) {
b = 0;
for (int i=0; i<8; i++) {
if (i < bitsLeft)
b = (b << 1) | (read_pbm_int(device) & 1);
else
b = (b << 1) | (0 & 1); // pad it our self if we need to
}
bitsLeft -= 8;
*p++ = b;
}
} else if (nbits == 8) {
if (mcc == 255) {
while (n--) {
*p++ = read_pbm_int(device);
}
} else {
while (n--) {
*p++ = read_pbm_int(device) * 255 / mcc;
}
}
} else { // 32 bits
n /= 4;
int r, g, b;
if (mcc == 255) {
while (n--) {
r = read_pbm_int(device);
g = read_pbm_int(device);
b = read_pbm_int(device);
*((QRgb*)p) = qRgb(r, g, b);
p += 4;
}
} else {
while (n--) {
r = read_pbm_int(device);
g = read_pbm_int(device);
b = read_pbm_int(device);
*((QRgb*)p) = scale_pbm_color(mcc, r, g, b);
p += 4;
}
}
}
}
}
if (format == QImage::Format_Mono) {
outImage->setColorCount(2);
outImage->setColor(0, qRgb(255,255,255)); // white
outImage->setColor(1, qRgb(0,0,0)); // black
}
return true;
}
static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, const QByteArray &sourceFormat)
{
QByteArray str;
QImage image = sourceImage;
QByteArray format = sourceFormat;
format = format.left(3); // ignore RAW part
bool gray = format == "pgm";
if (format == "pbm") {
image = image.convertToFormat(QImage::Format_Mono);
} else if (gray) {
image = image.convertToFormat(QImage::Format_Grayscale8);
} else {
switch (image.format()) {
case QImage::Format_Mono:
case QImage::Format_MonoLSB:
image = image.convertToFormat(QImage::Format_Indexed8);
break;
case QImage::Format_Indexed8:
case QImage::Format_RGB32:
case QImage::Format_ARGB32:
break;
default:
if (image.hasAlphaChannel())
image = image.convertToFormat(QImage::Format_ARGB32);
else
image = image.convertToFormat(QImage::Format_RGB32);
break;
}
}
if (image.depth() == 1 && image.colorCount() == 2) {
if (qGray(image.color(0)) < qGray(image.color(1))) {
// 0=dark/black, 1=light/white - invert
image.detach();
for (int y=0; y<image.height(); y++) {
uchar *p = image.scanLine(y);
uchar *end = p + image.bytesPerLine();
while (p < end)
*p++ ^= 0xff;
}
}
}
uint w = image.width();
uint h = image.height();
str = "P\n";
str += QByteArray::number(w);
str += ' ';
str += QByteArray::number(h);
str += '\n';
switch (image.depth()) {
case 1: {
str.insert(1, '4');
if (out->write(str, str.length()) != str.length())
return false;
w = (w+7)/8;
for (uint y=0; y<h; y++) {
uchar* line = image.scanLine(y);
if (w != (uint)out->write((char*)line, w))
return false;
}
}
break;
case 8: {
str.insert(1, gray ? '5' : '6');
str.append("255\n");
if (out->write(str, str.length()) != str.length())
return false;
uint bpl = w * (gray ? 1 : 3);
uchar *buf = new uchar[bpl];
if (image.format() == QImage::Format_Indexed8) {
QVector<QRgb> color = image.colorTable();
for (uint y=0; y<h; y++) {
const uchar *b = image.constScanLine(y);
uchar *p = buf;
uchar *end = buf+bpl;
if (gray) {
while (p < end) {
uchar g = (uchar)qGray(color[*b++]);
*p++ = g;
}
} else {
while (p < end) {
QRgb rgb = color[*b++];
*p++ = qRed(rgb);
*p++ = qGreen(rgb);
*p++ = qBlue(rgb);
}
}
if (bpl != (uint)out->write((char*)buf, bpl))
return false;
}
} else {
for (uint y=0; y<h; y++) {
const uchar *b = image.constScanLine(y);
uchar *p = buf;
uchar *end = buf + bpl;
if (gray) {
while (p < end)
*p++ = *b++;
} else {
while (p < end) {
uchar color = *b++;
*p++ = color;
*p++ = color;
*p++ = color;
}
}
if (bpl != (uint)out->write((char*)buf, bpl))
return false;
}
}
delete[] buf;
break;
}
case 32: {
str.insert(1, '6');
str.append("255\n");
if (out->write(str, str.length()) != str.length())
return false;
uint bpl = w * 3;
uchar *buf = new uchar[bpl];
for (uint y=0; y<h; y++) {
const QRgb *b = reinterpret_cast<const QRgb *>(image.constScanLine(y));
uchar *p = buf;
uchar *end = buf+bpl;
while (p < end) {
QRgb rgb = *b++;
*p++ = qRed(rgb);
*p++ = qGreen(rgb);
*p++ = qBlue(rgb);
}
if (bpl != (uint)out->write((char*)buf, bpl))
return false;
}
delete[] buf;
break;
}
default:
return false;
}
return true;
}
QPpmHandler::QPpmHandler()
: state(Ready)
{}
bool QPpmHandler::readHeader()
{
state = Error;
if (!read_pbm_header(device(), type, width, height, mcc))
return false;
state = ReadHeader;
return true;
}
bool QPpmHandler::canRead() const
{
if (state == Ready && !canRead(device(), &subType))
return false;
if (state != Error) {
setFormat(subType);
return true;
}
return false;
}
bool QPpmHandler::canRead(QIODevice *device, QByteArray *subType)
{
if (!device) {
qWarning("QPpmHandler::canRead() called with no device");
return false;
}
char head[2];
if (device->peek(head, sizeof(head)) != sizeof(head))
return false;
if (head[0] != 'P')
return false;
if (head[1] == '1' || head[1] == '4') {
if (subType)
*subType = "pbm";
} else if (head[1] == '2' || head[1] == '5') {
if (subType)
*subType = "pgm";
} else if (head[1] == '3' || head[1] == '6') {
if (subType)
*subType = "ppm";
} else {
return false;
}
return true;
}
bool QPpmHandler::read(QImage *image)
{
if (state == Error)
return false;
if (state == Ready && !readHeader()) {
state = Error;
return false;
}
if (!read_pbm_body(device(), type, width, height, mcc, image)) {
state = Error;
return false;
}
state = Ready;
return true;
}
bool QPpmHandler::write(const QImage &image)
{
return write_pbm_image(device(), image, subType);
}
bool QPpmHandler::supportsOption(ImageOption option) const
{
return option == SubType
|| option == Size
|| option == ImageFormat;
}
QVariant QPpmHandler::option(ImageOption option) const
{
if (option == SubType) {
return subType;
} else if (option == Size) {
if (state == Error)
return QVariant();
if (state == Ready && !const_cast<QPpmHandler*>(this)->readHeader())
return QVariant();
return QSize(width, height);
} else if (option == ImageFormat) {
if (state == Error)
return QVariant();
if (state == Ready && !const_cast<QPpmHandler*>(this)->readHeader())
return QVariant();
QImage::Format format = QImage::Format_Invalid;
switch (type) {
case '1': // ascii PBM
case '4': // raw PBM
format = QImage::Format_Mono;
break;
case '2': // ascii PGM
case '5': // raw PGM
format = QImage::Format_Grayscale8;
break;
case '3': // ascii PPM
case '6': // raw PPM
format = QImage::Format_RGB32;
break;
default:
break;
}
return format;
}
return QVariant();
}
void QPpmHandler::setOption(ImageOption option, const QVariant &value)
{
if (option == SubType)
subType = value.toByteArray().toLower();
}
QByteArray QPpmHandler::name() const
{
return subType.isEmpty() ? QByteArray("ppm") : subType;
}
QT_END_NAMESPACE
#endif // QT_NO_IMAGEFORMAT_PPM