Description
Function scanline in QSafeBitmapResource takes signed values, which can lead to uninformed programmer to give a negative value that the function does not check for:
const ARGB *QSafeBitmapResource::scanline(const qint32 pixelRow) const { const bool isAccessOK = (m_data != nullptr) && (pixelRow < height()); const ARGB *argbPtr = nullptr; if (isAccessOK) { // AXIVION Next Line MisraC++2023-8.2.5: Unavoidable cast to unrelated pointer type. The m_data is 4-byte aligned and is safe to convert to ARGB. argbPtr = reinterpret_cast<const ARGB*>(&m_data[pixelRow * width()]); } return argbPtr; }
Either make pixelRow a quint32, or add a lower bound check for it.
Attachments
For Gerrit Dashboard: QSR-2808 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
643515,3 | Add lower bound check to QSafeBitmap::scanline() | dev | tqtc-boot2qt/qtsaferenderer-runtime | Status: MERGED | +2 | 0 |