Fix additional issues reported by UB sanitizers

Most of these involved overrunning the signed 32-bit JLONG type whenever
building libjpeg-turbo with a 32-bit compiler.  These issues are not
believed to represent actual security threats, but eliminating them
makes it easier to detect such threats should they arise in the future.
This commit is contained in:
DRC
2015-10-14 22:26:25 -05:00
parent 1e32fe3113
commit d65e768b2e
6 changed files with 16 additions and 6 deletions

View File

@@ -29,6 +29,12 @@ backward API or ABI incompatibilities with prior libjpeg-turbo releases.
[6] The MIPS DSPr2 SIMD code can now be compiled to support either FR=0 or FR=1
FPUs.
[7] Fixed additional negative left shifts and other issues reported by the GCC
and Clang undefined behavior sanitizers. Most of these issues affected only
32-bit code, and none of them was known to pose a security threat, but removing
the warnings makes it easier to detect actual security issues, should they
arise in the future.
1.4.2
=====

View File

@@ -6,7 +6,7 @@
* libjpeg-turbo Modifications:
* Copyright (C) 1999-2006, MIYASAKA Masaru.
* Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
* Copyright (C) 2011, 2014-2015 D. R. Commander
* Copyright (C) 2011, 2014-2015, D. R. Commander.
* For conditions of distribution and use, see the accompanying README.ijg
* file.
*
@@ -209,7 +209,11 @@ compute_reciprocal (UINT16 divisor, DCTELEM * dtbl)
dtbl[DCTSIZE2 * 0] = (DCTELEM) fq; /* reciprocal */
dtbl[DCTSIZE2 * 1] = (DCTELEM) c; /* correction + roundfactor */
#ifdef WITH_SIMD
dtbl[DCTSIZE2 * 2] = (DCTELEM) (1 << (sizeof(DCTELEM)*8*2 - r)); /* scale */
#else
dtbl[DCTSIZE2 * 2] = 1;
#endif
dtbl[DCTSIZE2 * 3] = (DCTELEM) r - sizeof(DCTELEM)*8; /* shift */
if(r <= 16) return 0;

View File

@@ -231,7 +231,7 @@ emit_bits (phuff_entropy_ptr entropy, unsigned int code, int size)
/* Emit some bits, unless we are in gather mode */
{
/* This routine is heavily used, so it's worth coding tightly. */
register JLONG put_buffer = (JLONG) code;
register size_t put_buffer = (size_t) code;
register int put_bits = entropy->put_bits;
/* if size is 0, caller used an invalid Huffman table entry */

View File

@@ -604,7 +604,7 @@ ycck_cmyk_convert (j_decompress_ptr cinfo,
*/
#define DITHER_MASK 0x3
#define DITHER_ROTATE(x) (((x) << 24) | (((x) >> 8) & 0x00FFFFFF))
#define DITHER_ROTATE(x) ((((x) & 0xFF) << 24) | (((x) >> 8) & 0x00FFFFFF))
static const JLONG dither_matrix[4] = {
0x0008020A,
0x0C040E06,

View File

@@ -74,12 +74,12 @@ EXTERN(void) jpeg_make_d_derived_tbl
#if SIZEOF_SIZE_T==8 || defined(_WIN64)
typedef size_t bit_buf_type; /* type of bit-extraction buffer */
typedef size_t bit_buf_type; /* type of bit-extraction buffer */
#define BIT_BUF_SIZE 64 /* size of buffer in bits */
#else
typedef JLONG bit_buf_type; /* type of bit-extraction buffer */
typedef unsigned long bit_buf_type; /* type of bit-extraction buffer */
#define BIT_BUF_SIZE 32 /* size of buffer in bits */
#endif

View File

@@ -456,7 +456,7 @@ h2v2_merged_upsample (j_decompress_ptr cinfo,
*/
#define DITHER_MASK 0x3
#define DITHER_ROTATE(x) (((x) << 24) | (((x) >> 8) & 0x00FFFFFF))
#define DITHER_ROTATE(x) ((((x) & 0xFF) << 24) | (((x) >> 8) & 0x00FFFFFF))
static const JLONG dither_matrix[4] = {
0x0008020A,
0x0C040E06,