Prevents crashing when ICO file has bad color table value

When color table value is read from ICO header memory allocation is
made based on this value. This case is relevant only when reading
8bit images. Therefore values over 256 will abort reading the image.

Task-number: QT-4535

Merge-request: 1090
Reviewed-by: Harald Fernengel <harald.fernengel@nokia.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/src/plugins/imageformats/ico/qicohandler.cpp b/src/plugins/imageformats/ico/qicohandler.cpp
index 5aa26d3..701207d 100644
--- a/src/plugins/imageformats/ico/qicohandler.cpp
+++ b/src/plugins/imageformats/ico/qicohandler.cpp
@@ -559,6 +559,8 @@ QImage ICOReader::iconAt(int index)
                     icoAttrib.ncolors = 0;
                 else                    // # colors used
                     icoAttrib.ncolors = header.biClrUsed ? header.biClrUsed : 1 << icoAttrib.nbits;
+                if (icoAttrib.ncolors > 256) //color table can't be more than 256
+                    return img;
                 icoAttrib.w = iconEntry.bWidth;
                 if (icoAttrib.w == 0)
                     icoAttrib.w = header.biWidth;