Fixed memory corruption issue in qt_blurImage for Indexed8 images.

If transposed was set to 0 we did not check the color depth of the image
and ended up with a buffer overflow.

Reviewed-by: Jens Bache-Wiig

1 files changed, 11 insertions, 4 deletions

diff --git a/src/gui/image/qpixmapfilter.cpp b/src/gui/image/qpixmapfilter.cpp
index 70770c4..26bffcc 100644
--- a/src/gui/image/qpixmapfilter.cpp
+++ b/src/gui/image/qpixmapfilter.cpp
@@ -764,10 +764,17 @@ void expblur(QImage &img, qreal radius, bool improvedQuality = false, int transp
     }
 
     if (transposed == 0) {
-        qt_memrotate90(reinterpret_cast<const quint32*>(temp.bits()),
-                       temp.width(), temp.height(), temp.bytesPerLine(),
-                       reinterpret_cast<quint32*>(img.bits()),
-                       img.bytesPerLine());
+        if (img.depth() == 8) {
+            qt_memrotate90(reinterpret_cast<const quint8*>(temp.bits()),
+                           temp.width(), temp.height(), temp.bytesPerLine(),
+                           reinterpret_cast<quint8*>(img.bits()),
+                           img.bytesPerLine());
+        } else {
+            qt_memrotate90(reinterpret_cast<const quint32*>(temp.bits()),
+                           temp.width(), temp.height(), temp.bytesPerLine(),
+                           reinterpret_cast<quint32*>(img.bits()),
+                           img.bytesPerLine());
+        }
     } else {
         img = temp;
     }