Conversation
|
@mergify backport 0.28.x |
✅ Backports have been createdDetails
|
There was a problem hiding this comment.
Pull request overview
This PR addresses a UBSAN report in Image::appendIccProfile() by avoiding calling memcpy() with a null source pointer when size == 0, which can trip nonnull-annotated libc implementations during fuzzing.
Changes:
- Add an early return in
Image::appendIccProfile()whensize == 0to preventmemcpy()from being invoked in that case.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| } | ||
|
|
||
| void Image::appendIccProfile(const uint8_t* bytes, size_t size, bool bTestValid) { | ||
| if (size == 0) { |
There was a problem hiding this comment.
Early-returning on size == 0 skips the bTestValid path, so callers that rely on appendIccProfile(..., bTestValid=true) to validate the assembled ICC profile (e.g., the last JPEG chunk) will no longer run checkIccProfile(). Consider keeping the UBSAN fix while still validating: if size == 0 and bTestValid is true, call checkIccProfile() before returning (or otherwise ensure validation happens when the final chunk is empty).
| if (size == 0) { | |
| if (size == 0) { | |
| if (bTestValid) { | |
| checkIccProfile(); | |
| } |
This fixes a (false positive) error from UBSAN:
It's a false positive because
sizeis zero, so it doesn't matter thatbytesisNULL. But it's easy to fix by returning early ifsize == 0.