Skip to content

arm: avoid overflow in RGBA palette offset - #899

Open
soul-sol wants to merge 1 commit into
pnggroup:libpng18from
soul-sol:harden-neon-rgba-offset
Open

arm: avoid overflow in RGBA palette offset#899
soul-sol wants to merge 1 commit into
pnggroup:libpng18from
soul-sol:harden-neon-rgba-offset

Conversation

@soul-sol

Copy link
Copy Markdown

Summary

Promote row_width to size_t before multiplying it by the four-byte RGBA pixel size in the ARM NEON palette expansion path.

Without the promotion, 4 * row_width is evaluated as 32-bit unsigned arithmetic and wraps for widths greater than UINT32_MAX / 4. This matches the existing ARM NEON RGB path and the scalar RGBA implementation.

Fixes #862.

Verification

  • Confirmed the original expression wraps to offset 3 for row_width = 1,073,741,825, while the promoted expression yields 4,294,967,299.
  • Compiled pngsimd.c with Clang as an ARM64 Mach-O object using -Wall -Wextra -Werror.
  • Built shared and static libpng for AArch64 Ubuntu 24.04 with CMake.
  • Ran the full CTest suite on AArch64: 37/37 tests passed.
  • git diff --check passes.

Signed-off-by: solim <7576268+soul-sol@users.noreply.github.com>
@jbowler

jbowler commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Hum. As I implied in the comments I just attempted to preserve the "original code" bugs and all. At this point the code requires a maintainer.

Maintainer, step forward.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Missing size_t promotion in ARM NEON palette RGBA dp calculation

2 participants