diff options
| author | Thomas Bernard <miniupnp@free.fr> | 2020-02-08 13:43:35 +0100 |
|---|---|---|
| committer | Thomas Bernard <miniupnp@free.fr> | 2020-02-08 13:43:35 +0100 |
| commit | 4f168b7368eaab89d803ae9527016d527ed83713 (patch) | |
| tree | 660bb6210e599df5f7cc8e6360d74a5954733b34 | |
| parent | 3334704ebcec6a8011fc5ef5d0904d6297a0b9ff (diff) | |
| download | libtiff-git-4f168b7368eaab89d803ae9527016d527ed83713.tar.gz | |
tiffcrop: fix asan runtime error caused by integer promotion
tiffcrop.c:4027:20: runtime error: left shift of 190 by 24 places cannot be represented in type 'int'
C treats (byte << 24) as an int expression.
casting explicitely to unsigned type uint32 avoids the problem.
the same issue has been fixed elsewhere with a24213691616e7cd35aa3e2805493de80c7e4fcf
I detected the bug with the test file of #86
| -rw-r--r-- | tools/tiffcrop.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c index 29c19a2f..6cc5a2ce 100644 --- a/tools/tiffcrop.c +++ b/tools/tiffcrop.c @@ -4024,9 +4024,9 @@ combineSeparateSamples24bits (uint8 *in[], uint8 *out, uint32 cols, { src = in[s] + src_offset + src_byte; if (little_endian) - buff1 = (src[0] << 24) | (src[1] << 16) | (src[2] << 8) | src[3]; + buff1 = ((uint32)src[0] << 24) | ((uint32)src[1] << 16) | ((uint32)src[2] << 8) | (uint32)src[3]; else - buff1 = (src[3] << 24) | (src[2] << 16) | (src[1] << 8) | src[0]; + buff1 = ((uint32)src[3] << 24) | ((uint32)src[2] << 16) | ((uint32)src[1] << 8) | (uint32)src[0]; buff1 = (buff1 & matchbits) << (src_bit); /* If we have a full buffer's worth, write it out */ |