ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rdbmp.c: Fix innocuous UBSan error

Browse Source 
A fuzzing test case with an image width of 838860946 triggered a UBSan
error:

rdbmp.c:633:34: runtime error: signed integer overflow:
838860946 * 3 cannot be represented in type 'int'

Because the result is cast to an unsigned int (JDIMENSION), this error
is irrelevant, because

(unsigned int)((int)838860946 * (int)3) ==
(unsigned int)838860946 * (unsigned int)3
This commit is contained in:
DRC
2021-04-07 14:20:49 -05:00
parent 34d264d64e
commit 3311fc0001
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
rdbmp.c
View File

@@ -6,7 +6,7 @@
* Modified 2009-2017 by Guido Vollbeding. * Modified 2009-2017 by Guido Vollbeding.
* libjpeg-turbo Modifications: * libjpeg-turbo Modifications:
* Modified 2011 by Siarhei Siamashka. * Modified 2011 by Siarhei Siamashka.
* Copyright (C) 2015, 2017-2018, D. R. Commander. * Copyright (C) 2015, 2017-2018, 2021, D. R. Commander.
* For conditions of distribution and use, see the accompanying README.ijg * For conditions of distribution and use, see the accompanying README.ijg
* file. * file.
* *
@@ -631,7 +631,7 @@ start_input_bmp(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
/* Allocate one-row buffer for returned data */ /* Allocate one-row buffer for returned data */
source->pub.buffer = (*cinfo->mem->alloc_sarray) source->pub.buffer = (*cinfo->mem->alloc_sarray)
((j_common_ptr)cinfo, JPOOL_IMAGE, ((j_common_ptr)cinfo, JPOOL_IMAGE,
(JDIMENSION)(biWidth * cinfo->input_components), (JDIMENSION)1); (JDIMENSION)biWidth * (JDIMENSION)cinfo->input_components, (JDIMENSION)1);
source->pub.buffer_height = 1; source->pub.buffer_height = 1;
cinfo->data_precision = 8; cinfo->data_precision = 8;