mewin/libpng
1
0
Fork 0
mirror of https://git.code.sf.net/p/libpng/code.git synced 2025-07-10 18:04:09 +02:00
Code Issues Projects Releases Wiki Activity

Unsigned overflow

Browse Source 
Remove all currently detected cases of unsigned overflow.  Detection is
runtime, so test case dependent.  The changes to pngvalid.c eliminate
spurious and probably invalid tests with one while loop exception.

Apart from that and the change to the dependence on the intended
unsigned overflow in pngtrans.c the changes are limited to altering the
meme for an unsigned 'x' from:

   while (x-- > 0)

to

   for (; x > 0; --x)

This works because, in all cases, the control variable is not used in
the loop.  The 'while' meme was, at one time, warn'ed by GCC so it is
probably a good change, for some weird religious value of good.

Signed-off-by: John Bowler <jbowler@acm.org>
This commit is contained in:
John Bowler
2016-09-30 18:37:22 -07:00
parent 04dab1e82d
commit 319c9852bf
6 changed files with 52 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/libtests/pngunknown.c
View File

@@ -478,7 +478,7 @@ get_valid(display *d, png_infop info_ptr)
png_textp text;
png_uint_32 ntext = png_get_text(d->png_ptr, info_ptr, &text, NULL);
while (ntext-- > 0) switch (text[ntext].compression)
while (ntext > 0) switch (text[--ntext].compression)
{
case -1:
flags |= PNG_INFO_tEXt;

39
contrib/libtests/pngvalid.c
View File

@@ -1242,7 +1242,7 @@ store_image_check(const png_store* ps, png_const_structp pp, int iImage)
image += 2; /* skip image first row markers */
while (rows-- > 0)
for (; rows > 0; --rows)
{
if (image[-2] != 190 || image[-1] != 239)
png_error(pp, "row start overwritten");
@@ -11427,23 +11427,36 @@ perform_interlace_macro_validation(void)
*/
for (v=0;;)
{
/* The first two tests overflow if the pass row or column is outside
* the possible range for a 32-bit result. In fact the values should
* never be outside the range for a 31-bit result, but checking for 32
* bits here ensures that if an app uses a bogus pass row or column
* (just so long as it fits in a 32 bit integer) it won't get a
* possibly dangerous overflow.
*/
/* First the base 0 stuff: */
m = PNG_ROW_FROM_PASS_ROW(v, pass);
f = png_row_from_pass_row(v, pass);
if (m != f)
if (v < png_pass_rows(0xFFFFFFFFU, pass))
{
fprintf(stderr, "PNG_ROW_FROM_PASS_ROW(%u, %d) = %u != %x\n",
v, pass, m, f);
exit(99);
m = PNG_ROW_FROM_PASS_ROW(v, pass);
f = png_row_from_pass_row(v, pass);
if (m != f)
{
fprintf(stderr, "PNG_ROW_FROM_PASS_ROW(%u, %d) = %u != %x\n",
v, pass, m, f);
exit(99);
}
}
m = PNG_COL_FROM_PASS_COL(v, pass);
f = png_col_from_pass_col(v, pass);
if (m != f)
if (v < png_pass_cols(0xFFFFFFFFU, pass))
{
fprintf(stderr, "PNG_COL_FROM_PASS_COL(%u, %d) = %u != %x\n",
v, pass, m, f);
exit(99);
m = PNG_COL_FROM_PASS_COL(v, pass);
f = png_col_from_pass_col(v, pass);
if (m != f)
{
fprintf(stderr, "PNG_COL_FROM_PASS_COL(%u, %d) = %u != %x\n",
v, pass, m, f);
exit(99);
}
}
m = PNG_ROW_IN_INTERLACE_PASS(v, pass);