From 423ea5b499dedfd3503cd08a47a40d1d83aaa22b Mon Sep 17 00:00:00 2001
From: John Preston <johnprestonmail@gmail.com>
Date: Sat, 30 May 2020 22:37:03 +0400
Subject: [PATCH] Fix crash on invalid image data.

---
 Telegram/SourceFiles/app.cpp                  |  3 +++
 Telegram/SourceFiles/data/data_document.h     |  3 +++
 .../SourceFiles/data/data_document_media.cpp  | 20 ++++++++++++-------
 Telegram/SourceFiles/data/data_photo.h        |  3 +++
 .../SourceFiles/data/data_photo_media.cpp     | 11 +++++++---
 Telegram/SourceFiles/ui/image/image.cpp       |  4 +++-
 6 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/Telegram/SourceFiles/app.cpp b/Telegram/SourceFiles/app.cpp
index d0de88e9e..d7e04a3b2 100644
--- a/Telegram/SourceFiles/app.cpp
+++ b/Telegram/SourceFiles/app.cpp
@@ -320,6 +320,9 @@ namespace App {
 	}
 
 	QImage readImage(QByteArray data, QByteArray *format, bool opaque, bool *animated) {
+		if (data.isEmpty()) {
+			return QImage();
+		}
 		QByteArray tmpFormat;
 		QImage result;
 		QBuffer buffer(&data);
diff --git a/Telegram/SourceFiles/data/data_document.h b/Telegram/SourceFiles/data/data_document.h
index eea01639d..7015e96c6 100644
--- a/Telegram/SourceFiles/data/data_document.h
+++ b/Telegram/SourceFiles/data/data_document.h
@@ -177,6 +177,9 @@ public:
 	[[nodiscard]] QByteArray inlineThumbnailBytes() const {
 		return _inlineThumbnailBytes;
 	}
+	void clearInlineThumbnailBytes() {
+		_inlineThumbnailBytes = QByteArray();
+	}
 
 	[[nodiscard]] Storage::Cache::Key goodThumbnailCacheKey() const;
 	[[nodiscard]] bool goodThumbnailChecked() const;
diff --git a/Telegram/SourceFiles/data/data_document_media.cpp b/Telegram/SourceFiles/data/data_document_media.cpp
index 1f917b9de..67a0192f4 100644
--- a/Telegram/SourceFiles/data/data_document_media.cpp
+++ b/Telegram/SourceFiles/data/data_document_media.cpp
@@ -171,9 +171,14 @@ void DocumentMedia::setGoodThumbnail(QImage thumbnail) {
 
 Image *DocumentMedia::thumbnailInline() const {
 	if (!_inlineThumbnail) {
-		auto image = Images::FromInlineBytes(_owner->inlineThumbnailBytes());
-		if (!image.isNull()) {
-			_inlineThumbnail = std::make_unique<Image>(std::move(image));
+		const auto bytes = _owner->inlineThumbnailBytes();
+		if (!bytes.isEmpty()) {
+			auto image = Images::FromInlineBytes(bytes);
+			if (image.isNull()) {
+				_owner->clearInlineThumbnailBytes();
+			} else {
+				_inlineThumbnail = std::make_unique<Image>(std::move(image));
+			}
 		}
 	}
 	return _inlineThumbnail.get();
@@ -360,10 +365,11 @@ Image *DocumentMedia::getStickerSmall() {
 }
 
 void DocumentMedia::checkStickerLarge(not_null<FileLoader*> loader) {
-	if (_owner->sticker()
-		&& !_sticker
-		&& !loader->imageData().isNull()) {
-		_sticker = std::make_unique<Image>(loader->imageData());
+	if (_sticker || !_owner->sticker()) {
+		return;
+	}
+	if (auto image = loader->imageData(); !image.isNull()) {
+		_sticker = std::make_unique<Image>(std::move(image));
 	}
 }
 
diff --git a/Telegram/SourceFiles/data/data_photo.h b/Telegram/SourceFiles/data/data_photo.h
index 25cf6755c..bf13efcb4 100644
--- a/Telegram/SourceFiles/data/data_photo.h
+++ b/Telegram/SourceFiles/data/data_photo.h
@@ -88,6 +88,9 @@ public:
 	[[nodiscard]] QByteArray inlineThumbnailBytes() const {
 		return _inlineThumbnailBytes;
 	}
+	void clearInlineThumbnailBytes() {
+		_inlineThumbnailBytes = QByteArray();
+	}
 
 	void load(
 		Data::FileOrigin origin,
diff --git a/Telegram/SourceFiles/data/data_photo_media.cpp b/Telegram/SourceFiles/data/data_photo_media.cpp
index b79425827..a2b832510 100644
--- a/Telegram/SourceFiles/data/data_photo_media.cpp
+++ b/Telegram/SourceFiles/data/data_photo_media.cpp
@@ -34,9 +34,14 @@ not_null<PhotoData*> PhotoMedia::owner() const {
 
 Image *PhotoMedia::thumbnailInline() const {
 	if (!_inlineThumbnail) {
-		auto image = Images::FromInlineBytes(_owner->inlineThumbnailBytes());
-		if (!image.isNull()) {
-			_inlineThumbnail = std::make_unique<Image>(std::move(image));
+		const auto bytes = _owner->inlineThumbnailBytes();
+		if (!bytes.isEmpty()) {
+			auto image = Images::FromInlineBytes(bytes);
+			if (image.isNull()) {
+				_owner->clearInlineThumbnailBytes();
+			} else {
+				_inlineThumbnail = std::make_unique<Image>(std::move(image));
+			}
 		}
 	}
 	return _inlineThumbnail.get();
diff --git a/Telegram/SourceFiles/ui/image/image.cpp b/Telegram/SourceFiles/ui/image/image.cpp
index 59b265b1f..6fce4b879 100644
--- a/Telegram/SourceFiles/ui/image/image.cpp
+++ b/Telegram/SourceFiles/ui/image/image.cpp
@@ -112,7 +112,9 @@ Image::Image(const QString &path) : Image(ReadContent(path)) {
 Image::Image(const QByteArray &content) : Image(ReadImage(content)) {
 }
 
-Image::Image(QImage &&data) : _data(std::move(data)) {
+Image::Image(QImage &&data)
+: _data(data.isNull() ? Empty()->original() : std::move(data)) {
+	Expects(!_data.isNull());
 }
 
 not_null<Image*> Image::Empty() {