KPixmapIO bug in ShmSegment

Karl Vogel karl.vogel at
Sat Feb 8 13:53:12 GMT 2003

If the creation/attach of the shm segment fails, then bad things can happen. 

void KPixmapIO::putImage(QPixmap *dst, int dx, int dy, const QImage *src)

   if (m_bShm && (src->depth() > 1) && (d->bpp > 8) && (size > d->threshold))
        initXImage(src->width(), src->height());

The call to initXImage() can put bogus info in d->ximage->data, because it 
doesn't check if the createShmSegment() call is successfull

void KPixmapIO::initXImage(int w, int h) 
 if (d->ximage && (w == d->ximage->width) && (h == d->ximage->height)) 
 createXImage(w, h); 
 int size = d->ximage->bytes_per_line * d->ximage->height; 
 if (size > d->shmsize) 
 d->ximage->data = d->shminfo->shmaddr; 
If createShmSegment() is unable attach the shm segment, then it sets m_bShm to 
false. In this case d->shminfo->shmaddr is not valid! So there needs to be a 
test written for this case. 

Bumped onto this via:

More information about the kde-core-devel mailing list