Fwd: [glennrp/libpng] Undefined behaviour in pngutil.c (#149)

This bug report is correct.  I wasn't paying attention, did not
realize thought the "options" was limited to four (there's a
comment about that but I didn't see it).

We could recover the unused MIPS option, I suppose.
and/or rewrite the options mechanism to use
a png_uint_32 for png_ptr->opitons which would
allow a total of 16 options.

No one has even tried the MIPS feature as far as I can
tell, and I'm ready to remove it.  It isn't in libpng17.

Glenn

---------- Forwarded message ----------
From: irwir <notifications-9UaJU3cA/F/[email protected]>
Date: Mon, Jan 2, 2017 at 7:22 PM
Subject: [glennrp/libpng] Undefined behaviour in pngutil.c (#149)
To: glennrp/libpng <[email protected]>
Cc: Subscribed <[email protected]>


Line 423 in libpng16 pngutil.c is
if (((png_ptr->options >> PNG_IGNORE_ADLER32) & 3) == PNG_OPTION_ON)

png_ptr->options is png_byte and has 8 bits
PNG_IGNORE_ADLER32 equals 8
C/C++ standards claim that shift by the number of available bits (or more)
is an undefined behaviour.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<https://github.com/glennrp/libpng/issues/149>, or mute the thread
<https://github.com/notifications/unsubscribe-auth/ABe25shZH-f9fjyJSDYoOZCeKmYfD_uAks5rOZSvgaJpZM4LZRLw>
.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot

_______________________________________________
png-mng-implement mailing list
png-mng-implement-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/png-mng-implement