This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch master
in repository legacy-imlib2.
View the commit online.
commit 4a961dd4f5752249e3c1c8081ef99a03c7a7e58f
Author: Acts1631 <[email protected]>
AuthorDate: Fri Aug 21 18:54:29 2026 -0400
y4m: read high-bit-depth grayscale samples safely
The grayscale high-bit-depth paths cast attacker-controlled frame data
to a uint16_t pointer. A valid Y4M header can place that data at an odd
address, which faults on strict-alignment systems.
---
src/modules/loaders/loader_y4m.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/src/modules/loaders/loader_y4m.c b/src/modules/loaders/loader_y4m.c
index 0f6ab33..1a9e2b5 100644
--- a/src/modules/loaders/loader_y4m.c
+++ b/src/modules/loaders/loader_y4m.c
@@ -479,6 +479,12 @@ conv_mono_full(const uint8_t *y, int y_stride, const uint8_t *u, int u_stride,
return J400ToARGB(y, y_stride, dst, dst_stride, width, height);
}
+static uint16_t
+y4m_read_sample(const uint8_t *src)
+{
+ return ((uint16_t) src[1] << 8) | src[0];
+}
+
static int
_load(ImlibImage *im, int load_data)
{
@@ -665,7 +671,7 @@ _load(ImlibImage *im, int load_data)
for (int i = 0; i < y4m.w * y4m.h; ++i)
{
/* convert 10-bit to 8-bit */
- buf_y[i] = (uint8_t) ((*((uint16_t *) (y4m.y) + i)) >> 2);
+ buf_y[i] = y4m_read_sample((const uint8_t *)y4m.y + 2 * i) >> 2;
}
}
else if (y4m.colour_space == Y4M_PARSE_CS_MONO12)
@@ -677,7 +683,7 @@ _load(ImlibImage *im, int load_data)
for (int i = 0; i < y4m.w * y4m.h; ++i)
{
/* convert 12-bit to 8-bit */
- buf_y[i] = (uint8_t) ((*((uint16_t *) (y4m.y) + i)) >> 4);
+ buf_y[i] = y4m_read_sample((const uint8_t *)y4m.y + 2 * i) >> 4;
}
}
else if (y4m.colour_space == Y4M_PARSE_CS_MONO14)
@@ -689,7 +695,7 @@ _load(ImlibImage *im, int load_data)
for (int i = 0; i < y4m.w * y4m.h; ++i)
{
/* convert 14-bit to 8-bit */
- buf_y[i] = (uint8_t) ((*((uint16_t *) (y4m.y) + i)) >> 6);
+ buf_y[i] = y4m_read_sample((const uint8_t *)y4m.y + 2 * i) >> 6;
}
}
else if (y4m.colour_space == Y4M_PARSE_CS_MONO16)
@@ -701,7 +707,7 @@ _load(ImlibImage *im, int load_data)
for (int i = 0; i < y4m.w * y4m.h; ++i)
{
/* convert 16-bit to 8-bit */
- buf_y[i] = (uint8_t) ((*((uint16_t *) (y4m.y) + i)) >> 8);
+ buf_y[i] = y4m_read_sample((const uint8_t *)y4m.y + 2 * i) >> 8;
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
