36 lines
1.4 KiB
Diff
36 lines
1.4 KiB
Diff
From 5ee24b398bb67666f6d173763eaaedd9c36fb1e5 Mon Sep 17 00:00:00 2001
|
|
From: Dan Bloomberg <dan.bloomberg@gmail.com>
|
|
Date: Mon, 11 May 2020 11:17:30 -0700
|
|
Subject: [PATCH] Fixed issue 22140 in oss-fuzz: Heap-buffer-overflow * color
|
|
quantized pix must be 8 bpp before extra colors are added.
|
|
|
|
---
|
|
src/colorquant1.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/colorquant1.c b/src/colorquant1.c
|
|
index 52ddd386..c7a817d6 100644
|
|
--- a/src/colorquant1.c
|
|
+++ b/src/colorquant1.c
|
|
@@ -3315,7 +3315,7 @@ l_int32 i, j, w, h, wplc, wplm, wpld, ncolors, index;
|
|
l_int32 rval, gval, bval, val, minval, maxval;
|
|
l_int32 *lut;
|
|
l_uint32 *datac, *datam, *datad, *linec, *linem, *lined;
|
|
-PIX *pixc, *pixm, *pixg, *pixd;
|
|
+PIX *pix1, *pixc, *pixm, *pixg, *pixd;
|
|
PIXCMAP *cmap, *cmapd;
|
|
|
|
PROCNAME("pixFewColorsOctcubeQuantMixed");
|
|
@@ -3332,8 +3332,10 @@ PIXCMAP *cmap, *cmapd;
|
|
if (maxspan <= 2) maxspan = 15;
|
|
|
|
/* Start with a simple fixed octcube quantizer. */
|
|
- if ((pixc = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
|
|
+ if ((pix1 = pixFewColorsOctcubeQuant1(pixs, level)) == NULL)
|
|
return (PIX *)ERROR_PTR("too many colors", procName, NULL);
|
|
+ pixc = pixConvertTo8(pix1, 1); /* must be 8 bpp */
|
|
+ pixDestroy(&pix1);
|
|
|
|
/* Identify and save color entries in the colormap. Set up a LUT
|
|
* that returns -1 for any gray pixel. */
|