Coverage Report

Created: 2026-03-12 07:14

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/qtbase/src/gui/image/qbmphandler.cpp
Line
Count
Source
1
// Copyright (C) 2016 The Qt Company Ltd.
2
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
3
// Qt-Security score:critical reason:data-parser
4
5
#include "private/qbmphandler_p.h"
6
7
#ifndef QT_NO_IMAGEFORMAT_BMP
8
9
#include <qimage.h>
10
#include <qlist.h>
11
#include <qvariant.h>
12
13
QT_BEGIN_NAMESPACE
14
15
static void swapPixel01(QImage *image)        // 1-bpp: swap 0 and 1 pixels
16
114
{
17
114
    qsizetype i;
18
114
    if (image->depth() == 1 && image->colorCount() == 2) {
19
114
        uint *p = (uint *)image->bits();
20
114
        qsizetype nbytes = static_cast<qsizetype>(image->sizeInBytes());
21
38.3M
        for (i=0; i<nbytes/4; i++) {
22
38.3M
            *p = ~*p;
23
38.3M
            p++;
24
38.3M
        }
25
114
        uchar *p2 = (uchar *)p;
26
114
        for (i=0; i<(nbytes&3); i++) {
27
0
            *p2 = ~*p2;
28
0
            p2++;
29
0
        }
30
114
        QRgb t = image->color(0);                // swap color 0 and 1
31
114
        image->setColor(0, image->color(1));
32
114
        image->setColor(1, t);
33
114
    }
34
114
}
35
36
/*
37
    QImageIO::defineIOHandler("BMP", "^BM", 0,
38
                               read_bmp_image, write_bmp_image);
39
*/
40
41
/*****************************************************************************
42
  BMP (DIB) image read/write functions
43
 *****************************************************************************/
44
45
const int BMP_FILEHDR_SIZE = 14;                // size of BMP_FILEHDR data
46
47
static QDataStream &operator>>(QDataStream &s, BMP_FILEHDR &bf)
48
2.36k
{                                                // read file header
49
2.36k
    s.readRawData(bf.bfType, 2);
50
2.36k
    s >> bf.bfSize >> bf.bfReserved1 >> bf.bfReserved2 >> bf.bfOffBits;
51
2.36k
    return s;
52
2.36k
}
53
54
static QDataStream &operator<<(QDataStream &s, const BMP_FILEHDR &bf)
55
0
{                                                // write file header
56
0
    s.writeRawData(bf.bfType, 2);
57
0
    s << bf.bfSize << bf.bfReserved1 << bf.bfReserved2 << bf.bfOffBits;
58
0
    return s;
59
0
}
60
61
62
const int BMP_OLD  = 12;                        // old Windows/OS2 BMP size
63
const int BMP_WIN  = 40;                        // Windows BMP v3 size
64
const int BMP_OS2  = 64;                        // new OS/2 BMP size
65
const int BMP_WIN4 = 108;                       // Windows BMP v4 size
66
const int BMP_WIN5 = 124;                       // Windows BMP v5 size
67
68
const int BMP_RGB  = 0;                                // no compression
69
const int BMP_RLE8 = 1;                                // run-length encoded, 8 bits
70
const int BMP_RLE4 = 2;                                // run-length encoded, 4 bits
71
const int BMP_BITFIELDS = 3;                        // RGB values encoded in data as bit-fields
72
const int BMP_ALPHABITFIELDS = 4;                   // RGBA values encoded in data as bit-fields
73
74
75
static QDataStream &operator>>(QDataStream &s, BMP_INFOHDR &bi)
76
2.30k
{
77
2.30k
    s >> bi.biSize;
78
2.30k
    if (bi.biSize == BMP_WIN || bi.biSize == BMP_OS2 || bi.biSize == BMP_WIN4 || bi.biSize == BMP_WIN5) {
79
1.23k
        s >> bi.biWidth >> bi.biHeight >> bi.biPlanes >> bi.biBitCount;
80
1.23k
        s >> bi.biCompression >> bi.biSizeImage;
81
1.23k
        s >> bi.biXPelsPerMeter >> bi.biYPelsPerMeter;
82
1.23k
        s >> bi.biClrUsed >> bi.biClrImportant;
83
1.23k
        if (bi.biSize >= BMP_WIN4) {
84
417
            s >> bi.biRedMask >> bi.biGreenMask >> bi.biBlueMask >> bi.biAlphaMask;
85
417
            s >> bi.biCSType;
86
4.17k
            for (int i = 0; i < 9; ++i)
87
3.75k
                s >> bi.biEndpoints[i];
88
417
            s >> bi.biGammaRed >> bi.biGammaGreen >> bi.biGammaBlue;
89
417
            if (bi.biSize == BMP_WIN5)
90
394
                s >> bi.biIntent >> bi.biProfileData >> bi.biProfileSize >> bi.biReserved;
91
417
        }
92
1.23k
    }
93
1.06k
    else {                                        // probably old Windows format
94
1.06k
        qint16 w, h;
95
1.06k
        s >> w >> h >> bi.biPlanes >> bi.biBitCount;
96
1.06k
        bi.biWidth  = w;
97
1.06k
        bi.biHeight = h;
98
1.06k
        bi.biCompression = BMP_RGB;                // no compression
99
1.06k
        bi.biSizeImage = 0;
100
1.06k
        bi.biXPelsPerMeter = bi.biYPelsPerMeter = 0;
101
1.06k
        bi.biClrUsed = bi.biClrImportant = 0;
102
1.06k
    }
103
2.30k
    return s;
104
2.30k
}
105
106
static QDataStream &operator<<(QDataStream &s, const BMP_INFOHDR &bi)
107
0
{
108
0
    s << bi.biSize;
109
0
    s << bi.biWidth << bi.biHeight;
110
0
    s << bi.biPlanes;
111
0
    s << bi.biBitCount;
112
0
    s << bi.biCompression;
113
0
    s << bi.biSizeImage;
114
0
    s << bi.biXPelsPerMeter << bi.biYPelsPerMeter;
115
0
    s << bi.biClrUsed << bi.biClrImportant;
116
117
0
    if (bi.biSize >= BMP_WIN4) {
118
0
        s << bi.biRedMask << bi.biGreenMask << bi.biBlueMask << bi.biAlphaMask;
119
0
        s << bi.biCSType;
120
121
0
        for (int i = 0; i < 9; i++)
122
0
            s << bi.biEndpoints[i];
123
124
0
        s << bi.biGammaRed;
125
0
        s << bi.biGammaGreen;
126
0
        s << bi.biGammaBlue;
127
0
    }
128
129
0
    if (bi.biSize >= BMP_WIN5) {
130
0
        s << bi.biIntent;
131
0
        s << bi.biProfileData;
132
0
        s << bi.biProfileSize;
133
0
        s << bi.biReserved;
134
0
    }
135
136
0
    return s;
137
0
}
138
139
static uint calc_shift(uint mask)
140
1.21k
{
141
1.21k
    uint result = 0;
142
19.8k
    while ((mask >= 0x100) || (!(mask & 1) && mask)) {
143
18.6k
        result++;
144
18.6k
        mask >>= 1;
145
18.6k
    }
146
1.21k
    return result;
147
1.21k
}
148
149
static uint calc_scale(uint low_mask)
150
1.21k
{
151
1.21k
    uint result = 8;
152
6.65k
    while (low_mask && result) {
153
5.44k
        result--;
154
5.44k
        low_mask >>= 1;
155
5.44k
    }
156
1.21k
    return result;
157
1.21k
}
158
159
static inline uint apply_scale(uint value, uint scale)
160
9.88M
{
161
9.88M
    if (!(scale & 0x07)) // return immediately if scale == 8 or 0
162
2.96M
        return value;
163
164
6.92M
    uint filled = 8 - scale;
165
6.92M
    uint result = value << scale;
166
167
6.92M
    do {
168
6.92M
        result |= result >> filled;
169
6.92M
        filled <<= 1;
170
6.92M
    } while (filled < 8);
171
172
6.92M
    return result;
173
9.88M
}
174
175
static bool read_dib_fileheader(QDataStream &s, BMP_FILEHDR &bf)
176
2.36k
{
177
    // read BMP file header
178
2.36k
    if (!(s >> bf))
179
61
        return false;
180
181
    // check header
182
2.30k
    if (qstrncmp(bf.bfType,"BM",2) != 0)
183
0
        return false;
184
185
2.30k
    return true;
186
2.30k
}
187
188
static bool read_dib_infoheader(QDataStream &s, BMP_INFOHDR &bi)
189
2.30k
{
190
2.30k
    if (!(s >> bi))                                       // read BMP info header
191
179
        return false;
192
193
2.12k
    int nbits = bi.biBitCount;
194
2.12k
    int comp = bi.biCompression;
195
2.12k
    if (!(nbits == 1 || nbits == 4 || nbits == 8 || nbits == 16 || nbits == 24 || nbits == 32) ||
196
2.01k
        bi.biPlanes != 1 || comp > BMP_BITFIELDS)
197
169
        return false;                                        // weird BMP image
198
1.95k
    if (!(comp == BMP_RGB || (nbits == 4 && comp == BMP_RLE4) ||
199
712
        (nbits == 8 && comp == BMP_RLE8) || ((nbits == 16 || nbits == 32) && comp == BMP_BITFIELDS)))
200
129
         return false;                                // weird compression type
201
1.82k
    if (bi.biHeight == INT_MIN)
202
7
        return false; // out of range for positive int
203
1.82k
    if (bi.biWidth <= 0 || !bi.biHeight || quint64(bi.biWidth) * qAbs(bi.biHeight) > 16384 * 16384)
204
113
        return false;
205
206
1.70k
    return true;
207
1.82k
}
208
209
static bool read_dib_body(QDataStream &s, const BMP_INFOHDR &bi, qint64 datapos, qint64 startpos, QImage &image)
210
1.70k
{
211
1.70k
    QIODevice* d = s.device();
212
1.70k
    if (d->atEnd())                                // end of stream/file
213
24
        return false;
214
#if 0
215
    qDebug("offset...........%lld", datapos);
216
    qDebug("startpos.........%lld", startpos);
217
    qDebug("biSize...........%d", bi.biSize);
218
    qDebug("biWidth..........%d", bi.biWidth);
219
    qDebug("biHeight.........%d", bi.biHeight);
220
    qDebug("biPlanes.........%d", bi.biPlanes);
221
    qDebug("biBitCount.......%d", bi.biBitCount);
222
    qDebug("biCompression....%d", bi.biCompression);
223
    qDebug("biSizeImage......%d", bi.biSizeImage);
224
    qDebug("biXPelsPerMeter..%d", bi.biXPelsPerMeter);
225
    qDebug("biYPelsPerMeter..%d", bi.biYPelsPerMeter);
226
    qDebug("biClrUsed........%d", bi.biClrUsed);
227
    qDebug("biClrImportant...%d", bi.biClrImportant);
228
#endif
229
1.68k
    int w = bi.biWidth,         h = bi.biHeight,  nbits = bi.biBitCount;
230
1.68k
    int t = bi.biSize,         comp = bi.biCompression;
231
1.68k
    uint red_mask = 0;
232
1.68k
    uint green_mask = 0;
233
1.68k
    uint blue_mask = 0;
234
1.68k
    uint alpha_mask = 0;
235
1.68k
    uint red_shift = 0;
236
1.68k
    uint green_shift = 0;
237
1.68k
    uint blue_shift = 0;
238
1.68k
    uint alpha_shift = 0;
239
1.68k
    uint red_scale = 0;
240
1.68k
    uint green_scale = 0;
241
1.68k
    uint blue_scale = 0;
242
1.68k
    uint alpha_scale = 0;
243
1.68k
    bool bitfields = comp == BMP_BITFIELDS || comp == BMP_ALPHABITFIELDS;
244
245
1.68k
    if (!d->isSequential())
246
1.68k
        d->seek(startpos + bi.biSize); // goto start of colormap or masks
247
248
1.68k
    if (bi.biSize >= BMP_WIN4) {
249
473
        red_mask = bi.biRedMask;
250
473
        green_mask = bi.biGreenMask;
251
473
        blue_mask = bi.biBlueMask;
252
473
        alpha_mask = bi.biAlphaMask;
253
1.21k
    } else if (bitfields && (nbits == 16 || nbits == 32)) {
254
239
        if (d->read((char *)&red_mask, sizeof(red_mask)) != sizeof(red_mask))
255
8
            return false;
256
231
        if (d->read((char *)&green_mask, sizeof(green_mask)) != sizeof(green_mask))
257
7
            return false;
258
224
        if (d->read((char *)&blue_mask, sizeof(blue_mask)) != sizeof(blue_mask))
259
11
            return false;
260
213
        if (comp == BMP_ALPHABITFIELDS && d->read((char *)&alpha_mask, sizeof(alpha_mask)) != sizeof(alpha_mask))
261
0
            return false;
262
213
    }
263
264
1.65k
    bool transp = bitfields || (comp == BMP_RGB && nbits == 32 && alpha_mask == 0xff000000);
265
1.65k
    transp = transp && alpha_mask;
266
267
1.65k
    int ncols = 0;
268
1.65k
    int depth = 0;
269
1.65k
    QImage::Format format;
270
1.65k
    switch (nbits) {
271
236
        case 32:
272
274
        case 24:
273
539
        case 16:
274
539
            depth = 32;
275
539
            format = transp ? QImage::Format_ARGB32 : QImage::Format_RGB32;
276
539
            break;
277
313
        case 8:
278
727
        case 4:
279
727
            depth = 8;
280
727
            format = QImage::Format_Indexed8;
281
727
            break;
282
392
        case 1:
283
392
            depth = 1;
284
392
            format = QImage::Format_Mono;
285
392
            break;
286
0
        default:
287
0
            return false;
288
0
            break;
289
1.65k
    }
290
291
1.65k
    if (depth != 32) {
292
1.11k
        ncols = bi.biClrUsed ? bi.biClrUsed : 1 << nbits;
293
1.11k
        if (ncols < 1 || ncols > 256) // sanity check - don't run out of mem if color table is broken
294
90
            return false;
295
1.11k
    }
296
297
1.56k
    if (bi.biHeight < 0)
298
594
        h = -h;                  // support images with negative height
299
300
1.56k
    if (!QImageIOHandler::allocateImage(QSize(w, h), format, &image))
301
19
        return false;
302
1.54k
    if (ncols > 0) {                                // read color table
303
1.02k
        image.setColorCount(ncols);
304
1.02k
        uchar rgb[4];
305
1.02k
        int   rgb_len = t == BMP_OLD ? 3 : 4;
306
25.5k
        for (int i=0; i<ncols; i++) {
307
24.7k
            if (d->read((char *)rgb, rgb_len) != rgb_len)
308
168
                return false;
309
24.5k
            image.setColor(i, qRgb(rgb[2],rgb[1],rgb[0]));
310
24.5k
            if (d->atEnd())                        // truncated file
311
86
                return false;
312
24.5k
        }
313
1.02k
    } else if (bitfields && (nbits == 16 || nbits == 32)) {
314
302
        red_shift = calc_shift(red_mask);
315
302
        if (((red_mask >> red_shift) + 1) == 0)
316
0
            return false;
317
302
        red_scale = calc_scale(red_mask >> red_shift);
318
302
        green_shift = calc_shift(green_mask);
319
302
        if (((green_mask >> green_shift) + 1) == 0)
320
0
            return false;
321
302
        green_scale = calc_scale(green_mask >> green_shift);
322
302
        blue_shift = calc_shift(blue_mask);
323
302
        if (((blue_mask >> blue_shift) + 1) == 0)
324
0
            return false;
325
302
        blue_scale = calc_scale(blue_mask >> blue_shift);
326
302
        alpha_shift = calc_shift(alpha_mask);
327
302
        if (((alpha_mask >> alpha_shift) + 1) == 0)
328
0
            return false;
329
302
        alpha_scale = calc_scale(alpha_mask >> alpha_shift);
330
302
    } else if (comp == BMP_RGB && (nbits == 24 || nbits == 32)) {
331
165
        blue_mask = 0x000000ff;
332
165
        green_mask = 0x0000ff00;
333
165
        red_mask = 0x00ff0000;
334
165
        blue_shift = 0;
335
165
        green_shift = 8;
336
165
        red_shift = 16;
337
165
        blue_scale = green_scale = red_scale = 0;
338
165
        if (transp) {
339
6
            alpha_shift = calc_shift(alpha_mask);
340
6
            if (((alpha_mask >> alpha_shift) + 1) == 0)
341
0
                return false;
342
6
            alpha_scale = calc_scale(alpha_mask >> alpha_shift);
343
6
        }
344
165
    } else if (comp == BMP_RGB && nbits == 16) {
345
56
        blue_mask = 0x001f;
346
56
        green_mask = 0x03e0;
347
56
        red_mask = 0x7c00;
348
56
        blue_shift = 0;
349
56
        green_shift = 5;
350
56
        red_shift = 10;
351
56
        blue_scale = green_scale = red_scale = 3;
352
56
    }
353
354
1.29k
    image.setDotsPerMeterX(bi.biXPelsPerMeter);
355
1.29k
    image.setDotsPerMeterY(bi.biYPelsPerMeter);
356
357
#if 0
358
    qDebug("Rmask: %08x Rshift: %08x Rscale:%08x", red_mask, red_shift, red_scale);
359
    qDebug("Gmask: %08x Gshift: %08x Gscale:%08x", green_mask, green_shift, green_scale);
360
    qDebug("Bmask: %08x Bshift: %08x Bscale:%08x", blue_mask, blue_shift, blue_scale);
361
    qDebug("Amask: %08x Ashift: %08x Ascale:%08x", alpha_mask, alpha_shift, alpha_scale);
362
#endif
363
364
1.29k
    if (datapos >= 0 && datapos > d->pos()) {
365
324
        if (!d->isSequential())
366
324
            d->seek(datapos); // start of image data
367
324
    }
368
369
1.29k
    int             bpl = image.bytesPerLine();
370
1.29k
    uchar *data = image.bits();
371
372
1.29k
    if (nbits == 1) {                                // 1 bit BMP image
373
4.65k
        while (--h >= 0) {
374
4.64k
            if (d->read((char*)(data + h*bpl), bpl) != bpl)
375
186
                break;
376
4.64k
        }
377
198
        if (ncols == 2 && qGray(image.color(0)) < qGray(image.color(1)))
378
114
            swapPixel01(&image);                // pixel 0 is white!
379
198
    }
380
381
1.09k
    else if (nbits == 4) {                        // 4 bit BMP image
382
331
        int    buflen = ((w+7)/8)*4;
383
331
        uchar *buf    = new uchar[buflen];
384
331
        if (comp == BMP_RLE4) {                // run length compression
385
198
            int x=0, y=0, c, i;
386
198
            quint8 b;
387
198
            uchar *p = data + (h-1)*bpl;
388
198
            const uchar *endp = p + w;
389
38.4k
            while (y < h) {
390
38.3k
                if (!d->getChar((char *)&b))
391
145
                    break;
392
38.2k
                if (b == 0) {                        // escape code
393
13.3k
                    if (!d->getChar((char *)&b) || b == 1) {
394
44
                        y = h;                // exit loop
395
13.3k
                    } else switch (b) {
396
5.97k
                        case 0:                        // end of line
397
5.97k
                            x = 0;
398
5.97k
                            y++;
399
5.97k
                            p = data + (h-y-1)*bpl;
400
5.97k
                            break;
401
3.86k
                        case 2:                        // delta (jump)
402
3.86k
                        {
403
3.86k
                            quint8 tmp;
404
3.86k
                            d->getChar((char *)&tmp);
405
3.86k
                            x += tmp;
406
3.86k
                            d->getChar((char *)&tmp);
407
3.86k
                            y += tmp;
408
3.86k
                        }
409
410
                            // Protection
411
3.86k
                            if ((uint)x >= (uint)w)
412
1.01k
                                x = w-1;
413
3.86k
                            if ((uint)y >= (uint)h)
414
312
                                y = h-1;
415
416
3.86k
                            p = data + (h-y-1)*bpl + x;
417
3.86k
                            break;
418
3.49k
                        default:                // absolute mode
419
                            // Protection
420
3.49k
                            if (p + b > endp)
421
560
                                b = endp-p;
422
423
3.49k
                            i = (c = b)/2;
424
38.9k
                            while (i--) {
425
35.4k
                                d->getChar((char *)&b);
426
35.4k
                                *p++ = b >> 4;
427
35.4k
                                *p++ = b & 0x0f;
428
35.4k
                            }
429
3.49k
                            if (c & 1) {
430
558
                                unsigned char tmp;
431
558
                                d->getChar((char *)&tmp);
432
558
                                *p++ = tmp >> 4;
433
558
                            }
434
3.49k
                            if ((((c & 3) + 1) & 2) == 2)
435
405
                                d->getChar(nullptr);        // align on word boundary
436
3.49k
                            x += c;
437
13.3k
                    }
438
24.8k
                } else {                        // encoded mode
439
                    // Protection
440
24.8k
                    if (p + b > endp)
441
5.65k
                        b = endp-p;
442
443
24.8k
                    i = (c = b)/2;
444
24.8k
                    d->getChar((char *)&b);                // 2 pixels to be repeated
445
589k
                    while (i--) {
446
564k
                        *p++ = b >> 4;
447
564k
                        *p++ = b & 0x0f;
448
564k
                    }
449
24.8k
                    if (c & 1)
450
4.84k
                        *p++ = b >> 4;
451
24.8k
                    x += c;
452
24.8k
                }
453
38.2k
            }
454
198
        } else if (comp == BMP_RGB) {                // no compression
455
133
            memset(data, 0, h*bpl);
456
2.42k
            while (--h >= 0) {
457
2.41k
                if (d->read((char*)buf,buflen) != buflen)
458
121
                    break;
459
2.29k
                uchar *p = data + h*bpl;
460
2.29k
                uchar *b = buf;
461
1.31M
                for (int i=0; i<w/2; i++) {        // convert nibbles to bytes
462
1.31M
                    *p++ = *b >> 4;
463
1.31M
                    *p++ = *b++ & 0x0f;
464
1.31M
                }
465
2.29k
                if (w & 1)                        // the last nibble
466
1.41k
                    *p = *b >> 4;
467
2.29k
            }
468
133
        }
469
331
        delete [] buf;
470
331
    }
471
472
766
    else if (nbits == 8) {                        // 8 bit BMP image
473
243
        if (comp == BMP_RLE8) {                // run length compression
474
192
            int x=0, y=0;
475
192
            quint8 b;
476
192
            uchar *p = data + (h-1)*bpl;
477
192
            const uchar *endp = p + w;
478
314k
            while (y < h) {
479
314k
                if (!d->getChar((char *)&b))
480
87
                    break;
481
314k
                if (b == 0) {                        // escape code
482
114k
                    if (!d->getChar((char *)&b) || b == 1) {
483
40
                            y = h;                // exit loop
484
114k
                    } else switch (b) {
485
103k
                        case 0:                        // end of line
486
103k
                            x = 0;
487
103k
                            y++;
488
103k
                            p = data + (h-y-1)*bpl;
489
103k
                            break;
490
9.12k
                        case 2:                        // delta (jump)
491
9.12k
                            {
492
9.12k
                                quint8 tmp;
493
9.12k
                                d->getChar((char *)&tmp);
494
9.12k
                                x += tmp;
495
9.12k
                                d->getChar((char *)&tmp);
496
9.12k
                                y += tmp;
497
9.12k
                            }
498
499
                            // Protection
500
9.12k
                            if ((uint)x >= (uint)w)
501
8.86k
                                x = w-1;
502
9.12k
                            if ((uint)y >= (uint)h)
503
2.71k
                                y = h-1;
504
505
9.12k
                            p = data + (h-y-1)*bpl + x;
506
9.12k
                            break;
507
1.96k
                        default:                // absolute mode
508
                            // Protection
509
1.96k
                            if (p + b > endp)
510
372
                                b = endp-p;
511
512
1.96k
                            if (d->read((char *)p, b) != b)
513
55
                                return false;
514
1.90k
                            if ((b & 1) == 1)
515
836
                                d->getChar(nullptr);        // align on word boundary
516
1.90k
                            x += b;
517
1.90k
                            p += b;
518
114k
                    }
519
199k
                } else {                        // encoded mode
520
                    // Protection
521
199k
                    if (p + b > endp)
522
5.67k
                        b = endp-p;
523
524
199k
                    char tmp;
525
199k
                    d->getChar(&tmp);
526
199k
                    memset(p, tmp, b); // repeat pixel
527
199k
                    x += b;
528
199k
                    p += b;
529
199k
                }
530
314k
            }
531
192
        } else if (comp == BMP_RGB) {                // uncompressed
532
2.07k
            while (--h >= 0) {
533
2.06k
                if (d->read((char *)data + h*bpl, bpl) != bpl)
534
43
                    break;
535
2.06k
            }
536
51
        }
537
243
    }
538
539
523
    else if (nbits == 16 || nbits == 24 || nbits == 32) { // 16,24,32 bit BMP image
540
523
        QRgb *p;
541
523
        QRgb  *end;
542
523
        uchar *buf24 = new uchar[bpl];
543
523
        int    bpl24 = ((w*nbits+31)/32)*4;
544
523
        uchar *b;
545
523
        int c;
546
547
47.8k
        while (--h >= 0) {
548
47.8k
            p = (QRgb *)(data + h*bpl);
549
47.8k
            end = p + w;
550
47.8k
            if (d->read((char *)buf24,bpl24) != bpl24)
551
506
                break;
552
47.3k
            b = buf24;
553
3.34M
            while (p < end) {
554
3.29M
                c = *(uchar*)b | (*(uchar*)(b+1)<<8);
555
3.29M
                if (nbits > 16)
556
960k
                    c |= *(uchar*)(b+2)<<16;
557
3.29M
                if (nbits > 24)
558
960k
                    c |= *(uchar*)(b+3)<<24;
559
3.29M
                *p++ = qRgba(apply_scale((c & red_mask) >> red_shift, red_scale),
560
3.29M
                             apply_scale((c & green_mask) >> green_shift, green_scale),
561
3.29M
                             apply_scale((c & blue_mask) >> blue_shift, blue_scale),
562
3.29M
                             transp ? apply_scale((c & alpha_mask) >> alpha_shift, alpha_scale) : 0xff);
563
3.29M
                b += nbits/8;
564
3.29M
            }
565
47.3k
        }
566
523
        delete[] buf24;
567
523
    }
568
569
1.24k
    if (bi.biHeight < 0) {
570
        // Flip the image
571
503
        uchar *buf = new uchar[bpl];
572
503
        h = -bi.biHeight;
573
162M
        for (int y = 0; y < h/2; ++y) {
574
162M
            memcpy(buf, data + y*bpl, bpl);
575
162M
            memcpy(data + y*bpl, data + (h-y-1)*bpl, bpl);
576
162M
            memcpy(data + (h-y-1)*bpl, buf, bpl);
577
162M
        }
578
503
        delete [] buf;
579
503
    }
580
581
1.24k
    return true;
582
1.29k
}
583
584
bool qt_write_dib(QDataStream &s, const QImage &image, int bpl, int bpl_bmp, int nbits)
585
0
{
586
0
    QIODevice* d = s.device();
587
0
    if (!d->isWritable())
588
0
        return false;
589
590
0
    BMP_INFOHDR bi;
591
0
    bi.biSize               = BMP_WIN;                // build info header
592
0
    bi.biWidth               = image.width();
593
0
    bi.biHeight               = image.height();
594
0
    bi.biPlanes               = 1;
595
0
    bi.biBitCount      = nbits;
596
0
    bi.biCompression   = BMP_RGB;
597
0
    bi.biSizeImage     = bpl_bmp*image.height();
598
0
    bi.biXPelsPerMeter = image.dotsPerMeterX() ? image.dotsPerMeterX()
599
0
                                                : 2834; // 72 dpi default
600
0
    bi.biYPelsPerMeter = image.dotsPerMeterY() ? image.dotsPerMeterY() : 2834;
601
0
    bi.biClrUsed       = image.colorCount();
602
0
    bi.biClrImportant  = image.colorCount();
603
0
    if (!(s << bi))                                        // write info header
604
0
        return false;
605
606
0
    if (image.depth() != 32) {                // write color table
607
0
        uchar *color_table = new uchar[4*image.colorCount()];
608
0
        uchar *rgb = color_table;
609
0
        const QList<QRgb> c = image.colorTable();
610
0
        for (int i = 0; i < image.colorCount(); i++) {
611
0
            *rgb++ = qBlue (c[i]);
612
0
            *rgb++ = qGreen(c[i]);
613
0
            *rgb++ = qRed  (c[i]);
614
0
            *rgb++ = 0;
615
0
        }
616
0
        if (d->write((char *)color_table, 4*image.colorCount()) == -1) {
617
0
            delete [] color_table;
618
0
            return false;
619
0
        }
620
0
        delete [] color_table;
621
0
    }
622
623
0
    int y;
624
625
0
    if (nbits == 1 || nbits == 8) {                // direct output
626
0
        for (y=image.height()-1; y>=0; y--) {
627
0
            if (d->write((const char*)image.constScanLine(y), bpl) == -1)
628
0
                return false;
629
0
        }
630
0
        return true;
631
0
    }
632
633
0
    uchar *buf        = new uchar[bpl_bmp];
634
0
    uchar *b, *end;
635
0
    const uchar *p;
636
637
0
    memset(buf, 0, bpl_bmp);
638
0
    for (y=image.height()-1; y>=0; y--) {        // write the image bits
639
0
        if (nbits == 4) {                        // convert 8 -> 4 bits
640
0
            p = image.constScanLine(y);
641
0
            b = buf;
642
0
            end = b + image.width()/2;
643
0
            while (b < end) {
644
0
                *b++ = (*p << 4) | (*(p+1) & 0x0f);
645
0
                p += 2;
646
0
            }
647
0
            if (image.width() & 1)
648
0
                *b = *p << 4;
649
0
        } else {                                // 32 bits
650
0
            const QRgb *p   = (const QRgb *)image.constScanLine(y);
651
0
            const QRgb *end = p + image.width();
652
0
            b = buf;
653
0
            while (p < end) {
654
0
                *b++ = qBlue(*p);
655
0
                *b++ = qGreen(*p);
656
0
                *b++ = qRed(*p);
657
0
                p++;
658
0
            }
659
0
        }
660
0
        if (bpl_bmp != d->write((char*)buf, bpl_bmp)) {
661
0
            delete[] buf;
662
0
            return false;
663
0
        }
664
0
    }
665
0
    delete[] buf;
666
0
    return true;
667
0
}
668
669
QBmpHandler::QBmpHandler(InternalFormat fmt) :
670
2.36k
    m_format(fmt), state(Ready)
671
2.36k
{
672
2.36k
}
673
674
QByteArray QBmpHandler::formatName() const
675
1.62k
{
676
1.62k
    return m_format == BmpFormat ? "bmp" : "dib";
677
1.62k
}
678
679
bool QBmpHandler::readHeader()
680
2.36k
{
681
2.36k
    state = Error;
682
683
2.36k
    QIODevice *d = device();
684
2.36k
    QDataStream s(d);
685
2.36k
    startpos = d->pos();
686
687
    // Intel byte order
688
2.36k
    s.setByteOrder(QDataStream::LittleEndian);
689
690
    // read BMP file header
691
2.36k
    if (m_format == BmpFormat && !read_dib_fileheader(s, fileHeader))
692
61
        return false;
693
694
    // read BMP info header
695
2.30k
    if (!read_dib_infoheader(s, infoHeader))
696
597
        return false;
697
698
1.70k
    state = ReadHeader;
699
1.70k
    return true;
700
2.30k
}
701
702
bool QBmpHandler::canRead() const
703
1.62k
{
704
1.62k
    if (m_format == BmpFormat && state == Ready && !canRead(device()))
705
0
        return false;
706
707
1.62k
    if (state != Error) {
708
1.62k
        setFormat(formatName());
709
1.62k
        return true;
710
1.62k
    }
711
712
0
    return false;
713
1.62k
}
714
715
bool QBmpHandler::canRead(QIODevice *device)
716
40.0k
{
717
40.0k
    if (!device) {
718
0
        qWarning("QBmpHandler::canRead() called with 0 pointer");
719
0
        return false;
720
0
    }
721
722
40.0k
    char head[2];
723
40.0k
    if (device->peek(head, sizeof(head)) != sizeof(head))
724
14.8k
        return false;
725
726
25.1k
    return (qstrncmp(head, "BM", 2) == 0);
727
40.0k
}
728
729
bool QBmpHandler::read(QImage *image)
730
2.36k
{
731
2.36k
    if (state == Error)
732
0
        return false;
733
734
2.36k
    if (!image) {
735
0
        qWarning("QBmpHandler::read: cannot read into null pointer");
736
0
        return false;
737
0
    }
738
739
2.36k
    if (state == Ready && !readHeader()) {
740
658
        state = Error;
741
658
        return false;
742
658
    }
743
744
1.70k
    QIODevice *d = device();
745
1.70k
    QDataStream s(d);
746
747
    // Intel byte order
748
1.70k
    s.setByteOrder(QDataStream::LittleEndian);
749
750
    // read image
751
1.70k
    qint64 datapos = startpos;
752
1.70k
    if (m_format == BmpFormat) {
753
1.70k
        datapos += fileHeader.bfOffBits;
754
1.70k
    } else {
755
        // QTBUG-100351: We have no file header when reading dib format so we have to depend on the size of the
756
        // buffer and the biSizeImage value to find where the pixel data starts since there's sometimes optional
757
        // color mask values after biSize, like for example when pasting from the windows snipping tool.
758
0
        if (infoHeader.biSizeImage > 0 && infoHeader.biSizeImage < d->size()) {
759
0
            datapos = d->size() - infoHeader.biSizeImage;
760
0
        } else {
761
            // And sometimes biSizeImage is not filled in like when pasting from Microsoft Edge, so then we just
762
            // have to assume the optional color mask values are there.
763
0
            datapos += infoHeader.biSize;
764
765
0
            if (infoHeader.biBitCount == 16 || infoHeader.biBitCount == 32) {
766
0
                if (infoHeader.biCompression == BMP_BITFIELDS) {
767
0
                    datapos += 12;
768
0
                } else if (infoHeader.biCompression == BMP_ALPHABITFIELDS) {
769
0
                    datapos += 16;
770
0
                }
771
0
            }
772
0
        }
773
0
    }
774
1.70k
    const bool readSuccess = m_format == BmpFormat ?
775
1.70k
        read_dib_body(s, infoHeader, datapos, startpos + BMP_FILEHDR_SIZE, *image) :
776
1.70k
        read_dib_body(s, infoHeader, datapos, startpos, *image);
777
1.70k
    if (!readSuccess)
778
468
        return false;
779
780
1.24k
    state = Ready;
781
1.24k
    return true;
782
1.70k
}
783
784
bool QBmpHandler::write(const QImage &img)
785
0
{
786
0
    QImage image;
787
0
    switch (img.format()) {
788
0
    case QImage::Format_Mono:
789
0
    case QImage::Format_Indexed8:
790
0
    case QImage::Format_RGB32:
791
0
    case QImage::Format_ARGB32:
792
0
        image = img;
793
0
        break;
794
0
    case QImage::Format_MonoLSB:
795
0
        image = img.convertToFormat(QImage::Format_Mono);
796
0
        break;
797
0
    case QImage::Format_Alpha8:
798
0
    case QImage::Format_Grayscale8:
799
0
        image = img.convertToFormat(QImage::Format_Indexed8);
800
0
        break;
801
0
    default:
802
0
        if (img.hasAlphaChannel())
803
0
            image = img.convertToFormat(QImage::Format_ARGB32);
804
0
        else
805
0
            image = img.convertToFormat(QImage::Format_RGB32);
806
0
        break;
807
0
    }
808
809
0
    int nbits;
810
0
    qsizetype bpl_bmp;
811
    // Calculate a minimum bytes-per-line instead of using whatever value this QImage is using internally.
812
0
    qsizetype bpl = ((image.width() * image.depth() + 31) >> 5) << 2;
813
814
0
    if (image.depth() == 8 && image.colorCount() <= 16) {
815
0
        bpl_bmp = (((bpl+1)/2+3)/4)*4;
816
0
        nbits = 4;
817
0
   } else if (image.depth() == 32) {
818
0
        bpl_bmp = ((image.width()*24+31)/32)*4;
819
0
        nbits = 24;
820
0
    } else {
821
0
        bpl_bmp = bpl;
822
0
        nbits = image.depth();
823
0
    }
824
0
    if (qsizetype(int(bpl_bmp)) != bpl_bmp)
825
0
        return false;
826
827
0
    if (m_format == DibFormat) {
828
0
        QDataStream dibStream(device());
829
0
        dibStream.setByteOrder(QDataStream::LittleEndian); // Intel byte order
830
0
        return qt_write_dib(dibStream, img, bpl, bpl_bmp, nbits);
831
0
    }
832
833
0
    QIODevice *d = device();
834
0
    QDataStream s(d);
835
0
    BMP_FILEHDR bf;
836
837
    // Intel byte order
838
0
    s.setByteOrder(QDataStream::LittleEndian);
839
840
    // build file header
841
0
    memcpy(bf.bfType, "BM", 2);
842
843
    // write file header
844
0
    bf.bfReserved1 = 0;
845
0
    bf.bfReserved2 = 0;
846
0
    bf.bfOffBits = BMP_FILEHDR_SIZE + BMP_WIN + image.colorCount() * 4;
847
0
    bf.bfSize = bf.bfOffBits + bpl_bmp*image.height();
848
0
    if (qsizetype(bf.bfSize) != bf.bfOffBits + bpl_bmp*image.height())
849
0
        return false;
850
0
    s << bf;
851
852
    // write image
853
0
    return qt_write_dib(s, image, bpl, bpl_bmp, nbits);
854
0
}
855
856
bool QBmpHandler::supportsOption(ImageOption option) const
857
10.3k
{
858
10.3k
    return option == Size
859
10.3k
            || option == ImageFormat;
860
10.3k
}
861
862
QVariant QBmpHandler::option(ImageOption option) const
863
0
{
864
0
    if (option == Size) {
865
0
        if (state == Error)
866
0
            return QVariant();
867
0
        if (state == Ready && !const_cast<QBmpHandler*>(this)->readHeader())
868
0
            return QVariant();
869
0
        return QSize(infoHeader.biWidth, infoHeader.biHeight);
870
0
    } else if (option == ImageFormat) {
871
0
        if (state == Error)
872
0
            return QVariant();
873
0
        if (state == Ready && !const_cast<QBmpHandler*>(this)->readHeader())
874
0
            return QVariant();
875
0
        QImage::Format format;
876
0
        switch (infoHeader.biBitCount) {
877
0
            case 32:
878
0
            case 24:
879
0
            case 16:
880
0
                if ((infoHeader.biCompression == BMP_BITFIELDS || infoHeader.biCompression == BMP_ALPHABITFIELDS) && infoHeader.biSize >= BMP_WIN4 && infoHeader.biAlphaMask)
881
0
                    format = QImage::Format_ARGB32;
882
0
                else
883
0
                    format = QImage::Format_RGB32;
884
0
                break;
885
0
            case 8:
886
0
            case 4:
887
0
                format = QImage::Format_Indexed8;
888
0
                break;
889
0
            default:
890
0
                format = QImage::Format_Mono;
891
0
            }
892
0
        return format;
893
0
    }
894
0
    return QVariant();
895
0
}
896
897
void QBmpHandler::setOption(ImageOption option, const QVariant &value)
898
0
{
899
0
    Q_UNUSED(option);
900
    Q_UNUSED(value);
901
0
}
902
903
QT_END_NAMESPACE
904
905
#endif // QT_NO_IMAGEFORMAT_BMP