100 lines
3.2 KiB
Groff
100 lines
3.2 KiB
Groff
|
From 65470ac86c9d479e18c58c181170163925b5f9a1 Mon Sep 17 00:00:00 2001
|
||
|
|
From: John Bowler <jbowler@acm.org>
|
||
|
|
Date: Sat, 12 Oct 2024 14:55:03 -0700
|
||
|
|
Subject: [PATCH] fix: Avoid integer overflows in function `png_xy_from_XYZ`
|
||
|
|
|
||
|
|
This is a cherry-picked of commit f45531cc141dc20dc7a4046bbe92270b1e799a5d
|
||
|
|
from branch 'libpng18'.
|
||
|
|
|
||
|
|
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
|
||
|
|
Signed-off-by: John Bowler <jbowler@acm.org>
|
||
|
|
Signed-off-by: Cosmin Truta <ctruta@gmail.com>
|
||
|
|
---
|
||
|
|
png.c | 40 ++++++++++++++++++++++++----------------
|
||
|
|
1 file changed, 24 insertions(+), 16 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/png.c b/png.c
|
||
|
|
index 8cd0179a8..d99e2643b 100644
|
||
|
|
--- a/png.c
|
||
|
|
+++ b/png.c
|
||
|
|
@@ -1272,7 +1272,7 @@ png_safe_add(png_int_32 *addend0_and_result, png_int_32 addend1,
|
||
|
|
static int
|
||
|
|
png_xy_from_XYZ(png_xy *xy, const png_XYZ *XYZ)
|
||
|
|
{
|
||
|
|
- png_int_32 d, dred, dgreen, dwhite, whiteX, whiteY;
|
||
|
|
+ png_int_32 d, dred, dgreen, dblue, dwhite, whiteX, whiteY;
|
||
|
|
|
||
|
|
/* 'd' in each of the blocks below is just X+Y+Z for each component,
|
||
|
|
* x, y and z are X,Y,Z/(X+Y+Z).
|
||
|
|
@@ -1280,44 +1280,52 @@ png_xy_from_XYZ(png_xy *xy, const png_XYZ *XYZ)
|
||
|
|
d = XYZ->red_X;
|
||
|
|
if (png_safe_add(&d, XYZ->red_Y, XYZ->red_Z))
|
||
|
|
return 1;
|
||
|
|
- if (png_muldiv(&xy->redx, XYZ->red_X, PNG_FP_1, d) == 0)
|
||
|
|
+ dred = d;
|
||
|
|
+ if (png_muldiv(&xy->redx, XYZ->red_X, PNG_FP_1, dred) == 0)
|
||
|
|
return 1;
|
||
|
|
- if (png_muldiv(&xy->redy, XYZ->red_Y, PNG_FP_1, d) == 0)
|
||
|
|
+ if (png_muldiv(&xy->redy, XYZ->red_Y, PNG_FP_1, dred) == 0)
|
||
|
|
return 1;
|
||
|
|
- dred = d;
|
||
|
|
- whiteX = XYZ->red_X;
|
||
|
|
- whiteY = XYZ->red_Y;
|
||
|
|
|
||
|
|
d = XYZ->green_X;
|
||
|
|
if (png_safe_add(&d, XYZ->green_Y, XYZ->green_Z))
|
||
|
|
return 1;
|
||
|
|
- if (png_muldiv(&xy->greenx, XYZ->green_X, PNG_FP_1, d) == 0)
|
||
|
|
+ dgreen = d;
|
||
|
|
+ if (png_muldiv(&xy->greenx, XYZ->green_X, PNG_FP_1, dgreen) == 0)
|
||
|
|
return 1;
|
||
|
|
- if (png_muldiv(&xy->greeny, XYZ->green_Y, PNG_FP_1, d) == 0)
|
||
|
|
+ if (png_muldiv(&xy->greeny, XYZ->green_Y, PNG_FP_1, dgreen) == 0)
|
||
|
|
return 1;
|
||
|
|
- dgreen = d;
|
||
|
|
- whiteX += XYZ->green_X;
|
||
|
|
- whiteY += XYZ->green_Y;
|
||
|
|
|
||
|
|
d = XYZ->blue_X;
|
||
|
|
if (png_safe_add(&d, XYZ->blue_Y, XYZ->blue_Z))
|
||
|
|
return 1;
|
||
|
|
- if (png_muldiv(&xy->bluex, XYZ->blue_X, PNG_FP_1, d) == 0)
|
||
|
|
+ dblue = d;
|
||
|
|
+ if (png_muldiv(&xy->bluex, XYZ->blue_X, PNG_FP_1, dblue) == 0)
|
||
|
|
return 1;
|
||
|
|
- if (png_muldiv(&xy->bluey, XYZ->blue_Y, PNG_FP_1, d) == 0)
|
||
|
|
+ if (png_muldiv(&xy->bluey, XYZ->blue_Y, PNG_FP_1, dblue) == 0)
|
||
|
|
return 1;
|
||
|
|
- whiteX += XYZ->blue_X;
|
||
|
|
- whiteY += XYZ->blue_Y;
|
||
|
|
|
||
|
|
/* The reference white is simply the sum of the end-point (X,Y,Z) vectors so
|
||
|
|
* the fillowing calculates (X+Y+Z) of the reference white (media white,
|
||
|
|
* encoding white) itself:
|
||
|
|
*/
|
||
|
|
+ d = dblue;
|
||
|
|
if (png_safe_add(&d, dred, dgreen))
|
||
|
|
return 1;
|
||
|
|
-
|
||
|
|
dwhite = d;
|
||
|
|
|
||
|
|
+ /* Find the white X,Y values from the sum of the red, green and blue X,Y
|
||
|
|
+ * values.
|
||
|
|
+ */
|
||
|
|
+ d = XYZ->red_X;
|
||
|
|
+ if (png_safe_add(&d, XYZ->green_X, XYZ->blue_X))
|
||
|
|
+ return 1;
|
||
|
|
+ whiteX = d;
|
||
|
|
+
|
||
|
|
+ d = XYZ->red_Y;
|
||
|
|
+ if (png_safe_add(&d, XYZ->green_Y, XYZ->blue_Y))
|
||
|
|
+ return 1;
|
||
|
|
+ whiteY = d;
|
||
|
|
+
|
||
|
|
if (png_muldiv(&xy->whitex, whiteX, PNG_FP_1, dwhite) == 0)
|
||
|
|
return 1;
|
||
|
|
if (png_muldiv(&xy->whitey, whiteY, PNG_FP_1, dwhite) == 0)
|
||
|
|
--
|
||
|
|
2.46.1
|
||
|
|
|