GNOME Bugzilla – Bug 775242
bmp: State->Header.height can INT_MIN which negated does not fit in signed int
Last modified: 2016-12-13 17:46:05 UTC
Created attachment 340913 [details] crashing file, password "crash", found by afl a pathological BMP file can cause the following error: io-bmp.c:356:26: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself INT_MIN is -2147483648 and negating that does not fit in a signed int. Because I don't know what else to do, we error out.
Created attachment 340914 [details] [review] patch I don't know whether there is any more mild measure to take rather than to bail out. It gets rid of that special error, though. That bmp file produces other runtime errors which should probably be looked into.
Created attachment 341901 [details] [review] bmp: Error out when bottom-to-top BMP is too high BMP files with BITMAPV4HEADER can have negative height when the image is encoded botton-to-top, but when that negative height is INT_MIN, we cannot represent it as a positive integer (|INT_MIN| = INT_MAX + 1). Error out in this case.
Created attachment 341902 [details] [review] tests: Add test for bug 775242
Attachment 341901 [details] pushed as a3d6e40 - bmp: Error out when bottom-to-top BMP is too high Attachment 341902 [details] pushed as 08e388f - tests: Add test for bug 775242