Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-47998

Potential null pointer dereference in qjp2 lib Jpeg2000JasperReader::newRGBAImage

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P1: Critical
    • 5.6.0 RC
    • 5.5.1
    • Image formats
    • None
    • Windows, Qt5.5 32bit.
    • 3c68f26c052b06da9b43bb775cbe5a539fccb0c3

    Description

      Had crash reports from clients with the following trace:

      >	qjp2.dll!Jpeg2000JasperReader::newRGBAImage(const int width=1440, const int height=2560, bool alpha=false) Line 1044	C++
       	qjp2.dll!Jpeg2000JasperReader::write(const QImage & image={...}, int quality=-1) Line 780	C++
       	qjp2.dll!QJp2Handler::write(const QImage & image={...}) Line 250	C++
       	qwindows.dll!QWindowsOleDataObject::GetData(tagFORMATETC * pformatetc=0x005bf184, tagSTGMEDIUM * pmedium=0x005bf160) Line 144	C++
       	ole32.dll!HandleFromHandle(IDataObject * pDataObj, tagFORMATETC * pformatetc=0x005bf184, tagSTGMEDIUM * pmedium=0x005bf1c4) Line 2130	C++
       	ole32.dll!RenderCurrentFormat(HWND__ * hClipWnd, unsigned int cf=50201, tagSTGMEDIUM * pmedium=0x005bf1c4, IDataObject * pDataObj=0x104b60d8) Line 4002	C++
       	ole32.dll!RenderFormat(HWND__ * hClipWnd=0x0011153e, unsigned int cf=50201, IDataObject * pDataObj=0x104b60d8, void * pvMTADataObject=0x00000000) Line 4135	C++
       	ole32.dll!ClipboardWndProc(HWND__ * hWnd=0x0011153e, unsigned int msg=773, unsigned int wParam=50201, long lParam=0) Line 810	C++
       	user32.dll!__InternalCallWinProc@20()	Unknown
       	user32.dll!_UserCallWinProcCheckWow@36()	Unknown
       	user32.dll!_DispatchClientMessage@24()	Unknown
       	user32.dll!___fnDWORD@4()	Unknown
       	ntdll.dll!_KiUserCallbackDispatcher@12()	Unknown
       	user32.dll!_NtUserGetClipboardData@8()	Unknown
       	user32.dll!_GetClipboardData@4()	Unknown
       	ole32.dll!FlushViaUser32Render(HWND__ * hClipWnd, FORMATETCDATAARRAY * pFormatEtcDataArray=0x07a48748) Line 2338	C++
       	ole32.dll!OleFlushClipboardInternal(const wchar_t * pszCallerPackgeFullName, bool fInBroker, bool fTextOnly=false) Line 2590	C++
       	ole32.dll!OleFlushClipboard() Line 2285	C++
       	qwindows.dll!QWindowsClipboard::clipboardViewerWndProc(HWND__ * hwnd=0x0024180a, unsigned int message=2, unsigned int wParam=0, long lParam=0, long * result=0x005bf49c) Line 281	C++
       	qwindows.dll!qClipboardViewerWndProc(HWND__ * hwnd=0x0024180a, unsigned int message=2, unsigned int wParam=0, long lParam=0) Line 123	C++
       	user32.dll!__InternalCallWinProc@20()	Unknown
       	user32.dll!_UserCallWinProcCheckWow@36()	Unknown
       	user32.dll!_DispatchClientMessage@24()	Unknown
       	user32.dll!___fnDWORD@4()	Unknown
       	ntdll.dll!_KiUserCallbackDispatcher@12()	Unknown
       	kernel32.dll!@BaseThreadInitThunk@12()	Unknown
       	ntdll.dll!__RtlUserThreadStart()	Unknown
       	ntdll.dll!__RtlUserThreadStart@8()	Unknown
      

      Looking in qjp2handle.cpp, Jpeg2000JasperReader::newRGBAImage we can see the return value from jas_image_create is never checked before use in jas_image_setcmpttype.

      jas_image_create can return 0.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            neil Neil Williams
            neil Neil Williams
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes