Attachment 136224 Details for Bug 104294 – [PATCH 1/2] Make cd_color_get_blackbody_rgb_full safer

[patch] [PATCH 1/2] Make cd_color_get_blackbody_rgb_full safer

0001-Make-cd_color_get_blackbody_rgb_full-safer.patch (text/plain), 2.02 KB, created by Jan Alexander Steffens (heftig) on 2017-12-16 19:51:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Alexander Steffens (heftig)

Created: 2017-12-16 19:51:18 UTC

Size: 2.02 KB

patch

obsolete

>From 264981ddfd1984b25c629d8e3ef6cf25c70cc61a Mon Sep 17 00:00:00 2001
>Message-Id: <264981ddfd1984b25c629d8e3ef6cf25c70cc61a.1513453349.git.jan.steffens@gmail.com>
>From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
>Date: Sat, 16 Dec 2017 04:18:01 +0100
>Subject: [PATCH 1/2] Make cd_color_get_blackbody_rgb_full safer
>
>Validate arguments. If temp is divisible by 100, avoid interpolation
>because it accesses beyond the data for temp == 10000.
>---
> lib/colord/cd-color.c | 22 ++++++++++++++--------
> 1 file changed, 14 insertions(+), 8 deletions(-)
>
>diff --git a/lib/colord/cd-color.c b/lib/colord/cd-color.c
>index 6062595187616846..3907a7349c1351ba 100644
>--- a/lib/colord/cd-color.c
>+++ b/lib/colord/cd-color.c
>@@ -29,6 +29,7 @@
> #include "config.h"
> 
> #include <math.h>
>+#include <stdlib.h>
> #include <glib-object.h>
> #include <lcms2.h>
> 
>@@ -1444,33 +1445,38 @@ cd_color_get_blackbody_rgb_full (gdouble temp,
> 				 CdColorBlackbodyFlags flags)
> {
> 	gboolean ret = TRUE;
>-	gdouble alpha;
>-	gint temp_index;
>+	div_t temp_int;
> 	const CdColorRGB *blackbody_func = blackbody_data_d65modified;
> 
>+	g_return_val_if_fail (!isnan (temp), FALSE);
>+	g_return_val_if_fail (result != NULL, FALSE);
>+
> 	/* use modified curve */
> 	if (flags & CD_COLOR_BLACKBODY_FLAG_USE_PLANCKIAN)
> 		blackbody_func = blackbody_data_d65plankian;
> 
> 	/* check lower bound */
> 	if (temp < 1000) {
> 		ret = FALSE;
> 		temp = 1000;
> 	}
> 
> 	/* check upper bound */
> 	if (temp > 10000) {
> 		ret = FALSE;
> 		temp = 10000;
> 	}
> 
> 	/* bilinear interpolate the blackbody data */
>-	alpha = ((guint) temp % 100) / 100.0;
>-	temp_index = ((guint) temp - 1000) / 100;
>-	cd_color_rgb_interpolate (&blackbody_func[temp_index],
>-				  &blackbody_func[temp_index + 1],
>-				  alpha,
>-				  result);
>+	temp_int = div (temp, 100);
>+	if (temp_int.rem == 0)
>+		*result = blackbody_func[temp_int.quot - 10];
>+	else
>+		cd_color_rgb_interpolate (&blackbody_func[temp_int.quot - 10],
>+					  &blackbody_func[temp_int.quot - 9],
>+					  temp_int.rem / 100.0,
>+					  result);
>+
> 	return ret;
> }
> 
>-- 
>2.15.1
>

Actions: View | Splinter Review

Attachments on bug 104294: 136224 | 136226 | 136227 | 136239

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.