tree 8f02f3695a4f4ed11a6277f4a8491159a22f5b9e
parent dd830b3ffe30a76fbe8c1f13ebc7483c9ff792e5
author DRC <information@libjpeg-turbo.org> 1618241932 -0500
committer DRC <information@libjpeg-turbo.org> 1618246094 -0500

rdbmp.c: Fix more innocuous UBSan errors

- Referring to 3311fc00010c6cb305d87525c9ef60ebdf036cfc, we need to use
  unsigned intermediate math in order to make UBSan happy, even though
  (JDIMENSION)(A * B) is effectively the same as
  (JDIMENSION)A *(JDIMENSION)B, regardless of intermediate overflow.

- Because of the previous commit, it is now possible for bfOffBits to be
  INT_MIN, which would cause the initial computation of bPad to
  underflow a signed integer.  Thus, we need to check for that
  possibility as soon as we know the values of bfOffBits and headerSize.
  The worst case from this regression is that bPad could wrap around to
  a large positive value, which would cause a "Premature end of input
  file" error in the subsequent read_byte() loop.  Thus, this issue was
  effectively innocuous as well, since it resulted in catching the same
  error later and in a different way.  Also, the issue was very
  well-contained, since it was both introduced and fixed as part of the
  ongoing OSS-Fuzz integration project.