diff options
| author | Marti <marti.maria@tktbrainpower.com> | 2017-02-23 19:09:01 +0100 |
|---|---|---|
| committer | Marti <marti.maria@tktbrainpower.com> | 2017-02-23 19:09:01 +0100 |
| commit | 1272acb4b2e90088293874e9ab3c1d1e4f49f202 (patch) | |
| tree | da06fa0a7f1a638bfbc2d3efc7aad9e2159906f9 /src/cmscgats.c | |
| parent | 97ad8e42b27b13ad9dfe19bc56a637ef387f9189 (diff) | |
| download | lcms2-1272acb4b2e90088293874e9ab3c1d1e4f49f202.tar.gz | |
[oss-fuzz] Fix overflows in CGATS parser.
Fix some overflows in CGATS parser. Harmless.
Diffstat (limited to 'src/cmscgats.c')
| -rw-r--r-- | src/cmscgats.c | 26 |
1 files changed, 15 insertions, 11 deletions
diff --git a/src/cmscgats.c b/src/cmscgats.c index bff14d9..a203fc1 100644 --- a/src/cmscgats.c +++ b/src/cmscgats.c @@ -555,7 +555,7 @@ void ReadReal(cmsIT8* it8, cmsInt32Number inum) while (isdigit(it8->ch)) { - frac = frac * 10.0 + (it8->ch - '0'); + frac = frac * 10.0 + (cmsFloat64Number) (it8->ch - '0'); prec++; NextCh(it8); } @@ -585,8 +585,10 @@ void ReadReal(cmsIT8* it8, cmsInt32Number inum) e = 0; while (isdigit(it8->ch)) { - if ((cmsFloat64Number) e * 10.0 < (cmsFloat64Number) +2147483647.0) - e = e * 10 + (it8->ch - '0'); + cmsInt32Number digit = (it8->ch - '0'); + + if ((cmsFloat64Number) e * 10.0 + (cmsFloat64Number) digit < (cmsFloat64Number) +2147483647.0) + e = e * 10 + digit; NextCh(it8); } @@ -662,8 +664,10 @@ cmsFloat64Number ParseFloatNumber(const char *Buffer) e = 0; while (*Buffer && isdigit((int) *Buffer)) { - if ((cmsFloat64Number) e * 10L < INT_MAX) - e = e * 10 + (*Buffer - '0'); + cmsInt32Number digit = (*Buffer - '0'); + + if ((cmsFloat64Number) e * 10.0 + digit < (cmsFloat64Number)+2147483647.0) + e = e * 10 + digit; if (*Buffer) Buffer++; } @@ -738,7 +742,7 @@ void InSymbol(cmsIT8* it8) if (it8->ch >= 'A' && it8->ch <= 'F') j = it8->ch -'A'+10; else j = it8->ch - '0'; - if ((long) it8->inum * 16L > (long) INT_MAX) + if ((cmsFloat64Number) it8->inum * 16.0 + (cmsFloat64Number) j > (cmsFloat64Number)+2147483647.0) { SynError(it8, "Invalid hexadecimal number"); return; @@ -759,7 +763,7 @@ void InSymbol(cmsIT8* it8) { j = it8->ch - '0'; - if ((long) it8->inum * 2L > (long) INT_MAX) + if ((cmsFloat64Number) it8->inum * 2.0 + j > (cmsFloat64Number)+2147483647.0) { SynError(it8, "Invalid binary number"); return; @@ -1489,8 +1493,8 @@ cmsBool SetDataFormat(cmsIT8* it8, int n, const char *label) cmsBool CMSEXPORT cmsIT8SetDataFormat(cmsHANDLE h, int n, const char *Sample) { - cmsIT8* it8 = (cmsIT8*) h; - return SetDataFormat(it8, n, Sample); + cmsIT8* it8 = (cmsIT8*)h; + return SetDataFormat(it8, n, Sample); } static @@ -1515,8 +1519,8 @@ static char* GetData(cmsIT8* it8, int nSet, int nField) { TABLE* t = GetTable(it8); - int nSamples = t -> nSamples; - int nPatches = t -> nPatches; + int nSamples = t -> nSamples; + int nPatches = t -> nPatches; if (nSet >= nPatches || nField >= nSamples) return NULL; |