Skip to content

Avoid signed-shift UB in pngfix get32 - #901

Open
soul-sol wants to merge 1 commit into
pnggroup:libpng18from
soul-sol:fix-pngfix-get32-unsigned
Open

Avoid signed-shift UB in pngfix get32#901
soul-sol wants to merge 1 commit into
pnggroup:libpng18from
soul-sol:fix-pngfix-get32-unsigned

Conversation

@soul-sol

Copy link
Copy Markdown

Fixes #779.

get32 promoted each input byte to signed int before shifting. For a high byte such as 0x98, the expression 152 << 24 is not representable as int and triggers undefined behavior.

Reuse the existing PNG_U32 helper so every byte is converted to png_uint_32 before the shift. This keeps the decoded value unchanged while making the arithmetic defined.

Validation:

  • Reproduced the attached issue input on current libpng18 with Clang UBSan before the patch: runtime error: left shift of 152 by 24 places cannot be represented in type int.
  • The same input produces no UBSan diagnostic after the patch.
  • Full UBSan-enabled CTest suite: 37/37 passed.
  • Strict C90 Clang syntax check with warnings as errors passed.
  • git diff --check passed.

Signed-off-by: solim 7576268+soul-sol@users.noreply.github.com

Signed-off-by: solim <7576268+soul-sol@users.noreply.github.com>
@jbowler

jbowler commented Aug 16, 2026

Copy link
Copy Markdown
Contributor

@soul-sol where does "PNG_U32" come from?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] runtime error in pngfix.c

2 participants