QPixmap::toWinHBITMAP(): 2 Bugs when running out of memory (Access violation or lost HBITMAP handle)

1) Access violation in fastcopy_I+32

Call Stack (TraceStack_ME):
(QtGui4) fastcopy_I+32
EIP=6558d148, ESP=0012da94
( 1908867072, 0, 9088) <-- dst, src, len
71c70000 00000000 00002380 <-- same in hex
(QtGui4) _VEC_memcpy+82
EIP=6558d201, ESP=0012dac4
( 1908867072, 0, 9088)
71c70000 00000000 00002380
(QtGui4) QPixmap::toWinHBITMAP+361 at image\qpixmap_win.cpp:168

165 const QImage image = d->image.convertToFormat(imageFormat);
166 int bytes_per_line = w * 4;
167 for (int y=0; y<h; ++y)
168 memcpy(pixels + y * bytes_per_line, image.scanLine, bytes_per_line);

Reason:

• image.scanLine(0) returns 0 because image.isNull() isn't checked after line 165

Suggestion:

• error handling is easier, if the image is converted first:

...
QImage::Format imageFormat = QImage::Format_ARGB32;
if (format == NoAlpha)
imageFormat = QImage::Format_RGB32;
else if (format == PremultipliedAlpha)
imageFormat = QImage::Format_ARGB32_Premultiplied;

QImage image = toImage().convertToFormat(imageFormat);

if (image.isNull())

{ return 0; }

int w = image.width();
int h = image.height();

HDC display_dc = GetDC(0);

// Define the header
BITMAPINFO bmi;
....

2) lost HBITMAP handle

150 if (!bitmap)

{ 151 qErrnoWarning("QPixmap::toWinHBITMAP(), failed to create dibsection"); 152 return 0; 153 }

154 if (!pixels)

{ 155 qErrnoWarning("QPixmap::toWinHBITMAP(), did not allocate pixel data"); 156 return 0; 157 }

Reason:

• missing DeleteObject(bitmap) after line 155