cheng/libtiff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tiffcrop: fix asan runtime error caused by integer promotion

Browse Source 
tiffcrop.c:4027:20: runtime error: left shift of 190 by 24 places cannot be represented in type 'int'

C treats (byte << 24) as an int expression.
casting explicitely to unsigned type uint32 avoids the problem.

the same issue has been fixed elsewhere with a242136916

I detected the bug with the test file of #86
This commit is contained in:
Thomas Bernard 2020-02-08 13:43:35 +01:00
parent 3334704ebc
commit 4f168b7368
No known key found for this signature in database
GPG Key ID: 0FF11B67A5C0863C
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/tiffcrop.c
View File

@ -4024,9 +4024,9 @@ combineSeparateSamples24bits (uint8 *in[], uint8 *out, uint32 cols,
{ {
src = in[s] + src_offset + src_byte; src = in[s] + src_offset + src_byte;
if (little_endian) if (little_endian)
buff1 = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3]; buff1 = ((uint32)src[0] << 24) | ((uint32)src[1] << 16) | ((uint32)src[2] << 8) | (uint32)src[3];
else else
buff1 = (src[3] << 24) | (src[2] << 16) | (src[1] << 8) | src[0]; buff1 = ((uint32)src[3] << 24) | ((uint32)src[2] << 16) | ((uint32)src[1] << 8) | (uint32)src[0];
buff1 = (buff1 & matchbits) << (src_bit); buff1 = (buff1 & matchbits) << (src_bit);
/* If we have a full buffer's worth, write it out */ /* If we have a full buffer's worth, write it out */