Blame SOURCES/qt-bmp-image-handler-check-for-out-of-range-image-size.patch

9c5ecf
diff --git a/src/gui/image/qbmphandler.cpp b/src/gui/image/qbmphandler.cpp
9c5ecf
index 078c5993..5165bf19 100644
9c5ecf
--- a/src/gui/image/qbmphandler.cpp
9c5ecf
+++ b/src/gui/image/qbmphandler.cpp
9c5ecf
@@ -181,7 +181,8 @@ static bool read_dib_infoheader(QDataStream &s, BMP_INFOHDR &bi)
9c5ecf
     if (!(comp == BMP_RGB || (nbits == 4 && comp == BMP_RLE4) ||
9c5ecf
         (nbits == 8 && comp == BMP_RLE8) || ((nbits == 16 || nbits == 32) && comp == BMP_BITFIELDS)))
9c5ecf
          return false;                                // weird compression type
9c5ecf
-
9c5ecf
+    if (bi.biWidth < 0 || quint64(bi.biWidth) * qAbs(bi.biHeight) > 16384 * 16384)
9c5ecf
+        return false;
9c5ecf
     return true;
9c5ecf
 }
9c5ecf