Fix additional issues reported by UB sanitizers
Most of these involved overrunning the signed 32-bit JLONG type whenever building libjpeg-turbo with a 32-bit compiler. These issues are not believed to represent actual security threats, but eliminating them makes it easier to detect such threats should they arise in the future.
This commit is contained in:
@@ -29,6 +29,12 @@ backward API or ABI incompatibilities with prior libjpeg-turbo releases.
|
||||
[6] The MIPS DSPr2 SIMD code can now be compiled to support either FR=0 or FR=1
|
||||
FPUs.
|
||||
|
||||
[7] Fixed additional negative left shifts and other issues reported by the GCC
|
||||
and Clang undefined behavior sanitizers. Most of these issues affected only
|
||||
32-bit code, and none of them was known to pose a security threat, but removing
|
||||
the warnings makes it easier to detect actual security issues, should they
|
||||
arise in the future.
|
||||
|
||||
|
||||
1.4.2
|
||||
=====
|
||||
|
||||
@@ -6,7 +6,7 @@
|
||||
* libjpeg-turbo Modifications:
|
||||
* Copyright (C) 1999-2006, MIYASAKA Masaru.
|
||||
* Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
|
||||
* Copyright (C) 2011, 2014-2015 D. R. Commander
|
||||
* Copyright (C) 2011, 2014-2015, D. R. Commander.
|
||||
* For conditions of distribution and use, see the accompanying README.ijg
|
||||
* file.
|
||||
*
|
||||
@@ -209,7 +209,11 @@ compute_reciprocal (UINT16 divisor, DCTELEM * dtbl)
|
||||
|
||||
dtbl[DCTSIZE2 * 0] = (DCTELEM) fq; /* reciprocal */
|
||||
dtbl[DCTSIZE2 * 1] = (DCTELEM) c; /* correction + roundfactor */
|
||||
#ifdef WITH_SIMD
|
||||
dtbl[DCTSIZE2 * 2] = (DCTELEM) (1 << (sizeof(DCTELEM)*8*2 - r)); /* scale */
|
||||
#else
|
||||
dtbl[DCTSIZE2 * 2] = 1;
|
||||
#endif
|
||||
dtbl[DCTSIZE2 * 3] = (DCTELEM) r - sizeof(DCTELEM)*8; /* shift */
|
||||
|
||||
if(r <= 16) return 0;
|
||||
|
||||
@@ -231,7 +231,7 @@ emit_bits (phuff_entropy_ptr entropy, unsigned int code, int size)
|
||||
/* Emit some bits, unless we are in gather mode */
|
||||
{
|
||||
/* This routine is heavily used, so it's worth coding tightly. */
|
||||
register JLONG put_buffer = (JLONG) code;
|
||||
register size_t put_buffer = (size_t) code;
|
||||
register int put_bits = entropy->put_bits;
|
||||
|
||||
/* if size is 0, caller used an invalid Huffman table entry */
|
||||
|
||||
@@ -604,7 +604,7 @@ ycck_cmyk_convert (j_decompress_ptr cinfo,
|
||||
*/
|
||||
|
||||
#define DITHER_MASK 0x3
|
||||
#define DITHER_ROTATE(x) (((x) << 24) | (((x) >> 8) & 0x00FFFFFF))
|
||||
#define DITHER_ROTATE(x) ((((x) & 0xFF) << 24) | (((x) >> 8) & 0x00FFFFFF))
|
||||
static const JLONG dither_matrix[4] = {
|
||||
0x0008020A,
|
||||
0x0C040E06,
|
||||
|
||||
4
jdhuff.h
4
jdhuff.h
@@ -74,12 +74,12 @@ EXTERN(void) jpeg_make_d_derived_tbl
|
||||
|
||||
#if SIZEOF_SIZE_T==8 || defined(_WIN64)
|
||||
|
||||
typedef size_t bit_buf_type; /* type of bit-extraction buffer */
|
||||
typedef size_t bit_buf_type; /* type of bit-extraction buffer */
|
||||
#define BIT_BUF_SIZE 64 /* size of buffer in bits */
|
||||
|
||||
#else
|
||||
|
||||
typedef JLONG bit_buf_type; /* type of bit-extraction buffer */
|
||||
typedef unsigned long bit_buf_type; /* type of bit-extraction buffer */
|
||||
#define BIT_BUF_SIZE 32 /* size of buffer in bits */
|
||||
|
||||
#endif
|
||||
|
||||
@@ -456,7 +456,7 @@ h2v2_merged_upsample (j_decompress_ptr cinfo,
|
||||
*/
|
||||
|
||||
#define DITHER_MASK 0x3
|
||||
#define DITHER_ROTATE(x) (((x) << 24) | (((x) >> 8) & 0x00FFFFFF))
|
||||
#define DITHER_ROTATE(x) ((((x) & 0xFF) << 24) | (((x) >> 8) & 0x00FFFFFF))
|
||||
static const JLONG dither_matrix[4] = {
|
||||
0x0008020A,
|
||||
0x0C040E06,
|
||||
|
||||
Reference in New Issue
Block a user