From 5ee24b398bb67666f6d173763eaaedd9c36fb1e5 Mon Sep 17 00:00:00 2001 From: Dan Bloomberg Date: Mon, 11 May 2020 11:17:30 -0700 Subject: [PATCH] Fixed issue 22140 in oss-fuzz: Heap-buffer-overflow * color quantized pix must be 8 bpp before extra colors are added. --- src/colorquant1.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/colorquant1.c b/src/colorquant1.c index 52ddd386..c7a817d6 100644 --- a/src/colorquant1.c +++ b/src/colorquant1.c @@ -3315,7 +3315,7 @@ l_int32 i, j, w, h, wplc, wplm, wpld, ncolors, index; l_int32 rval, gval, bval, val, minval, maxval; l_int32 *lut; l_uint32 *datac, *datam, *datad, *linec, *linem, *lined; -PIX *pixc, *pixm, *pixg, *pixd; +PIX *pix1, *pixc, *pixm, *pixg, *pixd; PIXCMAP *cmap, *cmapd; PROCNAME("pixFewColorsOctcubeQuantMixed"); @@ -3332,8 +3332,10 @@ PIXCMAP *cmap, *cmapd; if (maxspan <= 2) maxspan = 15; /* Start with a simple fixed octcube quantizer. */ - if ((pixc = pixFewColorsOctcubeQuant1(pixs, level)) == NULL) + if ((pix1 = pixFewColorsOctcubeQuant1(pixs, level)) == NULL) return (PIX *)ERROR_PTR("too many colors", procName, NULL); + pixc = pixConvertTo8(pix1, 1); /* must be 8 bpp */ + pixDestroy(&pix1); /* Identify and save color entries in the colormap. Set up a LUT * that returns -1 for any gray pixel. */