4 files changed, 77 insertions, 16 deletions
diff --git a/src/gui/image/qpaintengine_pic.cpp b/src/gui/image/qpaintengine_pic.cpp
index ba4888cef75..b151c3b2d18 100644
--- a/src/gui/image/qpaintengine_pic.cpp
+++ b/src/gui/image/qpaintengine_pic.cpp
@@ -31,6 +31,7 @@ public:
     QDataStream s;
     QPainter *pt;
     QPicturePrivate *pic_d;
+    bool sizeLimitExceeded = false;
 };
 
 QPicturePaintEngine::QPicturePaintEngine()
@@ -68,6 +69,7 @@ bool QPicturePaintEngine::begin(QPaintDevice *pd)
     d->s.setVersion(d->pic_d->formatMajor);
 
     d->pic_d->pictb.open(QIODevice::WriteOnly | QIODevice::Truncate);
+    d->sizeLimitExceeded = false;
     d->s.writeRawData(qt_mfhdr_tag, 4);
     d->s << (quint16) 0 << (quint16) d->pic_d->formatMajor << (quint16) d->pic_d->formatMinor;
     d->s << (quint8) QPicturePrivate::PdcBegin << (quint8) sizeof(qint32);
@@ -109,7 +111,7 @@ bool QPicturePaintEngine::end()
     d->s << cs;                                // write checksum
     d->pic_d->pictb.close();
     setActive(false);
-    return true;
+    return !d->sizeLimitExceeded;
 }
 
 #define SERIALIZE_CMD(c) \
@@ -286,6 +288,19 @@ void QPicturePaintEngine::updateRenderHints(QPainter::RenderHints hints)
 void QPicturePaintEngine::writeCmdLength(int pos, const QRectF &r, bool corr)
 {
     Q_D(QPicturePaintEngine);
+
+    constexpr int sizeLimit = std::numeric_limits<int>::max() - 8; // Leave room for ending bytes
+    if (d->sizeLimitExceeded || d->pic_d->pictb.pos() > sizeLimit) {
+        d->pic_d->trecs--;  // Remove last command added, started by SERIALIZE_CMD
+        d->pic_d->pictb.seek(pos - 2);
+        d->pic_d->pictbData.resize(pos - 2);
+        if (!d->sizeLimitExceeded) {
+            d->sizeLimitExceeded = true;
+            qWarning("QPicture: size limit exceeded, will be truncated");
+        }
+        return;
+    }
+
     int newpos = d->pic_d->pictb.pos();            // new position
     int length = newpos - pos;
     QRectF br(r);
diff --git a/src/gui/image/qpicture.cpp b/src/gui/image/qpicture.cpp
index ac0525d7abf..db2a5fd9ba9 100644
--- a/src/gui/image/qpicture.cpp
+++ b/src/gui/image/qpicture.cpp
@@ -970,7 +970,8 @@ QPicture& QPicture::operator=(const QPicture &p)
   Constructs a QPicturePrivate
 */
 QPicturePrivate::QPicturePrivate()
-    : in_memory_only(false)
+    : pictb(&pictbData),
+      in_memory_only(false)
 {
 }
 
@@ -980,7 +981,8 @@ QPicturePrivate::QPicturePrivate()
   Copy-Constructs a QPicturePrivate. Needed when detaching.
 */
 QPicturePrivate::QPicturePrivate(const QPicturePrivate &other)
-    : trecs(other.trecs),
+    : pictb(&pictbData),
+      trecs(other.trecs),
       formatOk(other.formatOk),
       formatMinor(other.formatMinor),
       brect(other.brect),
diff --git a/src/gui/image/qpicture_p.h b/src/gui/image/qpicture_p.h
index c512f49320b..1d8142f44b7 100644
--- a/src/gui/image/qpicture_p.h
+++ b/src/gui/image/qpicture_p.h
@@ -113,6 +113,7 @@ public:
     bool checkFormat();
     void resetFormat();
 
+    QByteArray pictbData;
     QBuffer pictb;
     int trecs;
     bool formatOk;
diff --git a/src/gui/image/qppmhandler.cpp b/src/gui/image/qppmhandler.cpp
index a0a1dcdaca9..8a413ded95e 100644
--- a/src/gui/image/qppmhandler.cpp
+++ b/src/gui/image/qppmhandler.cpp
@@ -123,8 +123,8 @@ static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, Q
             break;
         case '2':                                // ascii PGM
         case '5':                                // raw PGM
-            nbits = 8;
-            format = QImage::Format_Grayscale8;
+            nbits = mcc <= std::numeric_limits<uint8_t>::max() ? 8 : 16;
+            format = mcc <= std::numeric_limits<uint8_t>::max() ? QImage::Format_Grayscale8 : QImage::Format_Grayscale16;
             break;
         case '3':                                // ascii PPM
         case '6':                                // raw PPM
@@ -175,20 +175,20 @@ static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, Q
                 }
             }
             delete[] buf24;
-        } else if (nbits == 8 && mcc > 255) {  // type 5 16bit
-            pbm_bpl = 2*w;
+        } else if (nbits == 16) {  // type 5 16bit
+            pbm_bpl = sizeof(uint16_t)*w;
             uchar *buf16 = new uchar[pbm_bpl];
             for (y=0; y<h; y++) {
                 if (device->read((char *)buf16, pbm_bpl) != pbm_bpl) {
                     delete[] buf16;
                     return false;
                 }
-                uchar *p = outImage->scanLine(y);
-                uchar *end = p + w;
-                uchar *b = buf16;
+                uint16_t *p = reinterpret_cast<uint16_t *>(outImage->scanLine(y));
+                uint16_t *end = p + w;
+                uint16_t *b = reinterpret_cast<uint16_t *>(buf16);
                 while (p < end) {
-                    *p++ = (b[0] << 8 | b[1]) * 255 / mcc;
-                    b += 2;
+                    *p++ = qFromBigEndian(*b) * std::numeric_limits<uint16_t>::max() / mcc;
+                    b++;
                 }
             }
             delete[] buf16;
@@ -225,13 +225,25 @@ static bool read_pbm_body(QIODevice *device, char type, int w, int h, int mcc, Q
                     *p++ = b;
                 }
             } else if (nbits == 8) {
-                if (mcc == 255) {
+                if (mcc == std::numeric_limits<uint8_t>::max()) {
                     while (n-- && ok) {
                         *p++ = read_pbm_int(device, &ok);
                     }
                 } else {
                     while (n-- && ok) {
-                        *p++ = (read_pbm_int(device, &ok) & 0xffff) * 255 / mcc;
+                        *p++ = (read_pbm_int(device, &ok) & 0xffff) * std::numeric_limits<uint8_t>::max() / mcc;
+                    }
+                }
+            } else if (nbits == 16) {
+                uint16_t* data = reinterpret_cast<uint16_t*>(p);
+                qsizetype numPixel = n/2;
+                if (mcc == std::numeric_limits<uint16_t>::max()) {
+                    while (numPixel-- && ok) {
+                        *data++ = read_pbm_int(device, &ok);
+                    }
+                }  else {
+                    while (numPixel-- && ok) {
+                        *data++ = (read_pbm_int(device, &ok) & 0xffff) * std::numeric_limits<uint16_t>::max() / mcc;
                     }
                 }
             } else {                                // 32 bits
@@ -280,7 +292,7 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, QByteArra
     if (format == "pbm") {
         image = image.convertToFormat(QImage::Format_Mono);
     } else if (gray) {
-        image = image.convertToFormat(QImage::Format_Grayscale8);
+        image = image.depth() <= 8 ? image.convertToFormat(QImage::Format_Grayscale8) : image.convertToFormat(QImage::Format_Grayscale16);
     } else {
         switch (image.format()) {
         case QImage::Format_Mono:
@@ -388,6 +400,34 @@ static bool write_pbm_image(QIODevice *out, const QImage &sourceImage, QByteArra
             delete [] buf;
             break;
         }
+        case 16: {
+            str.insert(1, gray ? '5' : '6');
+            str.append("65535\n");
+            if (out->write(str, str.size()) != str.size())
+                return false;
+            qsizetype bpl = sizeof(uint16_t) * qsizetype(w) * (gray ? 1 : 3);
+            uchar *buf = new uchar[bpl];
+            for (uint y=0; y<h; y++) {
+                const uint16_t *b = reinterpret_cast<const uint16_t *>(image.constScanLine(y));
+                uint16_t *p = reinterpret_cast<uint16_t *>(buf);
+                uint16_t *end = reinterpret_cast<uint16_t *>(buf + bpl);
+                if (gray) {
+                    while (p < end)
+                        *p++ = qToBigEndian(*b++);
+                } else {
+                    while (p < end) {
+                        uchar color = qToBigEndian(*b++);
+                        *p++ = color;
+                        *p++ = color;
+                        *p++ = color;
+                    }
+                }
+                if (bpl != (qsizetype)out->write((char*)buf, bpl))
+                    return false;
+            }
+            delete [] buf;
+            break;
+        }
 
         case 32: {
             str.insert(1, '6');
@@ -530,7 +570,10 @@ QVariant QPpmHandler::option(ImageOption option) const
                 break;
             case '2':                                // ascii PGM
             case '5':                                // raw PGM
-                format = QImage::Format_Grayscale8;
+                if (mcc <= std::numeric_limits<uint8_t>::max())
+                    format = QImage::Format_Grayscale8;
+                else
+                    format = QImage::Format_Grayscale16;
                 break;
             case '3':                                // ascii PPM
             case '6':                                // raw PPM