Merge branch '8.16'

jcupitt · jcupitt · commit 68d859f9b7cc · 2025-03-10T13:34:35.000Z
diff --git a/ChangeLog b/ChangeLog
@@ -27,14 +27,20 @@
 - heifsave: set image orientation using irot and imir transformations [lovell]
 - XYZ2Yxy: guard against divide by zero
 - fix MSVC compile error [na-trium-144]
-- exif: ensure enumerated entries can to converted to string values [lovell]
+- exif: ensure enumerated entries can be converted to string values [lovell]
 - gifsave: add support for eval callback, ensure correct return code [lovell]
 - tiffsave: honor disc threshold during pyramid save [kleisauke]
 - fill_nearest: fix a leak
 - colour: use suggested rendering intent as fallback [kleisauke]
 - morph: fix Orc path with large masks [kleisauke]
 - invertlut: fix final value in some cases
 - matrixload: fix file format detect for some matrix types
+- radload: improve sanity check of colour-related headers [lovell]
+- heifsave: reject multiband images [lovell]
+- heifload: prevent possible int overflow for large images [kleisauke]
+- tiffload: add missing read loop [kleisauke]
+- prevent possible use-after-free when debugging via `--vips-leak` flag [lovell]
+- avoid possible overflow when multiplication result is cast up [lovell]
 
 10/10/24 8.16.0
 
diff --git a/libvips/arithmetic/hist_find_indexed.c b/libvips/arithmetic/hist_find_indexed.c
@@ -117,8 +117,8 @@ histogram_new(VipsHistFindIndexed *indexed)
 		!(hist->reg = vips_region_new(indexed->index_ready)))
 		return NULL;
 
-	memset(hist->bins, 0, bands * hist->size * sizeof(double));
-	memset(hist->init, 0, hist->size * sizeof(int));
+	memset(hist->bins, 0, (size_t) bands * hist->size * sizeof(double));
+	memset(hist->init, 0, (size_t) hist->size * sizeof(int));
 
 	return hist;
 }
diff --git a/libvips/arithmetic/project.c b/libvips/arithmetic/project.c
@@ -109,8 +109,8 @@ histogram_new(VipsProject *project)
 		!hist->row_sums)
 		return NULL;
 
-	memset(hist->column_sums, 0, psize * in->Xsize);
-	memset(hist->row_sums, 0, psize * in->Ysize);
+	memset(hist->column_sums, 0, (size_t) psize * in->Xsize);
+	memset(hist->row_sums, 0, (size_t) psize * in->Ysize);
 
 	return hist;
 }
diff --git a/libvips/colour/LCh2UCS.c b/libvips/colour/LCh2UCS.c
@@ -165,9 +165,9 @@ vips_col_Ch2hcmc(float C, float h)
 	}
 
 	P = cos(VIPS_RAD(k7 * h + k8));
-	D = k4 + k5 * P * pow(fabs(P), k6);
+	D = k4 + k5 * P * powf(fabsf(P), k6);
 	g = C * C * C * C;
-	f = sqrt(g / (g + 1900.0));
+	f = sqrtf(g / (g + 1900.0F));
 	hcmc = h + D * f;
 
 	return hcmc;
diff --git a/libvips/conversion/bandfold.c b/libvips/conversion/bandfold.c
@@ -96,7 +96,7 @@ vips_bandfold_gen(VipsRegion *out_region,
 		/* We can't use vips_region_region() since we change pixel
 		 * coordinates.
 		 */
-		memcpy(q, p, psize * r->width);
+		memcpy(q, p, (size_t) psize * r->width);
 	}
 
 	return 0;
diff --git a/libvips/conversion/bandunfold.c b/libvips/conversion/bandunfold.c
@@ -99,7 +99,7 @@ vips_bandunfold_gen(VipsRegion *out_region,
 		/* We can't use vips_region_region() since we change pixel
 		 * coordinates.
 		 */
-		memcpy(q, p, r->width * psize);
+		memcpy(q, p, (size_t) r->width * psize);
 	}
 
 	return 0;
diff --git a/libvips/conversion/composite.cpp b/libvips/conversion/composite.cpp
@@ -899,7 +899,7 @@ vips_composite_base_blend3(VipsCompositeSequence *seq,
 			/* You can't sqrt a vector, so we must loop.
 			 */
 			for (int b = 0; b < 3; b++) {
-				double g;
+				float g;
 
 				if (B[b] <= 0.25)
 					g = ((16 * B[b] - 12) * B[b] + 4) * B[b];
diff --git a/libvips/conversion/embed.c b/libvips/conversion/embed.c
@@ -217,7 +217,7 @@ vips_embed_base_paint_edge(VipsEmbedBase *base,
 		 */
 		for (y = 0; y < todo.height; y++) {
 			q = VIPS_REGION_ADDR(out_region, todo.left, todo.top + y);
-			memcpy(q, p, bs * todo.width);
+			memcpy(q, p, (size_t) bs * todo.width);
 		}
 	}
 
diff --git a/libvips/foreign/heifload.c b/libvips/foreign/heifload.c
@@ -351,6 +351,9 @@ vips_foreign_load_heif_build(VipsObject *object)
 
 		heif->ctx = heif_context_alloc();
 #ifdef HAVE_HEIF_SET_MAX_IMAGE_SIZE_LIMIT
+		/* heifsave is limited to a maximum image size of 16384x16384,
+		 * so align the heifload defaults accordingly.
+		 */
 		heif_context_set_maximum_image_size_limit(heif->ctx,
 			heif->unlimited ? USHRT_MAX : 0x4000);
 #endif /* HAVE_HEIF_SET_MAX_IMAGE_SIZE_LIMIT */
@@ -998,7 +1001,7 @@ vips_foreign_load_heif_generate(VipsRegion *out_region,
 	}
 
 	memcpy(VIPS_REGION_ADDR(out_region, 0, r->top),
-		heif->data + heif->stride * line,
+		heif->data + (size_t) heif->stride * line,
 		VIPS_IMAGE_SIZEOF_LINE(out_region->im));
 
 	/* We may need to swap bytes and shift to fill 16 bits.
diff --git a/libvips/foreign/heifsave.c b/libvips/foreign/heifsave.c
@@ -466,7 +466,7 @@ vips_foreign_save_heif_write_block(VipsRegion *region, VipsRect *area,
 		int page = (area->top + y) / heif->page_height;
 		int line = (area->top + y) % heif->page_height;
 		VipsPel *p = VIPS_REGION_ADDR(region, 0, area->top + y);
-		VipsPel *q = heif->data + line * heif->stride;
+		VipsPel *q = heif->data + (size_t) heif->stride * line;
 
 		if (vips_foreign_save_heif_pack(heif,
 				q, p, VIPS_REGION_N_ELEMENTS(region)))
@@ -683,6 +683,15 @@ vips_foreign_save_heif_build(VipsObject *object)
 		return -1;
 	}
 
+	/* Reject multiband images.
+	 */
+	if (save->ready->Type == VIPS_INTERPRETATION_MULTIBAND) {
+		vips_error("heifsave", _("Unsupported interpretation: %s"),
+			vips_enum_nick(VIPS_TYPE_INTERPRETATION,
+				save->ready->Type));
+		return -1;
+	}
+
 	/* Make a heif image the size of a page. We send sink_disc() output
 	 * here and write a frame each time it fills.
 	 */
diff --git a/libvips/foreign/jp2ksave.c b/libvips/foreign/jp2ksave.c
@@ -482,7 +482,7 @@ vips_foreign_save_jp2k_sizeof_tile(VipsForeignSaveJp2k *jp2k, VipsRect *tile)
 			(double) tile->height / comp->dy);
 		;
 
-		size += output_width * output_height * sizeof_element;
+		size += (size_t) output_width * output_height * sizeof_element;
 	}
 
 	return size;
diff --git a/libvips/foreign/nsgifload.c b/libvips/foreign/nsgifload.c
@@ -517,7 +517,7 @@ vips_foreign_load_nsgif_generate(VipsRegion *out_region,
 			gif->frame_number = page;
 		}
 
-		p = (VipsPel *) gif->bitmap + line * gif->info->width * sizeof(int);
+		p = (VipsPel *) gif->bitmap + (size_t) line * gif->info->width * sizeof(int);
 		q = VIPS_REGION_ADDR(out_region, 0, r->top + y);
 		if (gif->has_transparency)
 			memcpy(q, p, VIPS_REGION_SIZEOF_LINE(out_region));
diff --git a/libvips/foreign/radiance.c b/libvips/foreign/radiance.c
@@ -229,8 +229,8 @@ typedef float RGBPRIMS[4][2]; /* (x,y) chromaticities for RGBW */
 #define COLCORSTR "COLORCORR="
 #define LCOLCORSTR 10
 #define iscolcor(hl) (!strncmp(hl, COLCORSTR, LCOLCORSTR))
-#define colcorval(cc, hl) sscanf((hl) + LCOLCORSTR, "%f %f %f", \
-	&(cc)[RED], &(cc)[GRN], &(cc)[BLU])
+#define colcorval(cc, hl) (sscanf((hl) + LCOLCORSTR, "%f %f %f", \
+							   &(cc)[RED], &(cc)[GRN], &(cc)[BLU]) == 3)
 
 #define MINELEN 8	   /* minimum scanline length for encoding */
 #define MAXELEN 0x7fff /* maximum scanline length for encoding */
@@ -643,15 +643,17 @@ rad2vips_process_line(char *line, Read *read)
 		COLOR cc;
 		int i;
 
-		(void) colcorval(cc, line);
+		if (!colcorval(cc, line))
+			return -1;
 		for (i = 0; i < 3; i++)
 			read->colcor[i] *= cc[i];
 	}
 	else if (isaspect(line)) {
 		read->aspect *= aspectval(line);
 	}
 	else if (isprims(line)) {
-		(void) primsval(read->prims, line);
+		if (!primsval(read->prims, line))
+			return -1;
 	}
 
 	return 0;
diff --git a/libvips/foreign/tiff.c b/libvips/foreign/tiff.c
@@ -104,7 +104,24 @@ openin_source_read(thandle_t st, tdata_t data, tsize_t size)
 {
 	VipsSource *source = VIPS_SOURCE(st);
 
-	return vips_source_read(source, data, size);
+	gint64 total_read;
+
+	total_read = 0;
+
+	while (total_read < size) {
+		gint64 bytes_read;
+
+		bytes_read = vips_source_read(source, data, size - total_read);
+		if (bytes_read == -1)
+			return -1;
+		if (bytes_read == 0)
+			break;
+
+		total_read += bytes_read;
+		data = (char *) data + bytes_read;
+	}
+
+	return total_read;
 }
 
 static tsize_t
diff --git a/libvips/foreign/tiff2vips.c b/libvips/foreign/tiff2vips.c
@@ -1696,7 +1696,7 @@ static void
 rtiff_memcpy_f16_line(Rtiff *rtiff, VipsPel *q, VipsPel *p, int n, void *client)
 {
 	VipsImage *im = (VipsImage *) client;
-	size_t len = n * im->Bands;
+	size_t len = (size_t) n * im->Bands;
 
 	if (im->BandFmt == VIPS_FORMAT_COMPLEX ||
 		im->BandFmt == VIPS_FORMAT_DPCOMPLEX)
@@ -2134,7 +2134,7 @@ rtiff_decompress_jpeg_run(Rtiff *rtiff, j_decompress_ptr cinfo,
 	}
 
 	jpeg_calc_output_dimensions(cinfo);
-	bytes_per_scanline = cinfo->output_width * bytes_per_pixel;
+	bytes_per_scanline = (size_t) cinfo->output_width * bytes_per_pixel;
 
 	/* Double-check tile dimensions.
 	 */
diff --git a/libvips/foreign/vips2tiff.c b/libvips/foreign/vips2tiff.c
@@ -2315,7 +2315,7 @@ wtiff_copy_tiles(Wtiff *wtiff, TIFF *out, TIFF *in)
 	 * simpler than searching every page for the largest tile with
 	 * TIFFTAG_TILEBYTECOUNTS.
 	 */
-	tile_size = 2 * wtiff->tls * wtiff->tileh;
+	tile_size = (tsize_t) 2 * wtiff->tls * wtiff->tileh;
 
 	buf = vips_malloc(NULL, tile_size);
 
diff --git a/libvips/foreign/webp2vips.c b/libvips/foreign/webp2vips.c
@@ -305,7 +305,7 @@ vips_image_paint_image(VipsImage *frame,
 			}
 			else
 				memcpy((char *) q, (char *) p,
-					ovl.width * ps);
+					(size_t) ovl.width * ps);
 
 			p += VIPS_IMAGE_SIZEOF_LINE(sub);
 			q += VIPS_IMAGE_SIZEOF_LINE(frame);
diff --git a/libvips/foreign/webpsave.c b/libvips/foreign/webpsave.c
@@ -355,7 +355,7 @@ vips_foreign_save_webp_sink_disc(VipsRegion *region, VipsRect *area, void *a)
 		memcpy(webp->frame_bytes +
 				area->width * webp->write_y * save->ready->Bands,
 			VIPS_REGION_ADDR(region, 0, area->top + i),
-			area->width * save->ready->Bands);
+			(size_t) area->width * save->ready->Bands);
 
 		webp->write_y += 1;
 
diff --git a/libvips/iofuncs/image.c b/libvips/iofuncs/image.c
@@ -3239,7 +3239,7 @@ vips_image_write_line(VipsImage *image, int ypos, VipsPel *linebuffer)
 
 	/* Trigger evaluation callbacks for this image.
 	 */
-	vips_image_eval(image, ypos * image->Xsize);
+	vips_image_eval(image, (guint64) ypos * image->Xsize);
 	if (vips_image_iskilled(image))
 		return -1;
 
diff --git a/libvips/iofuncs/sink.c b/libvips/iofuncs/sink.c
@@ -238,7 +238,7 @@ sink_area_allocate_fn(VipsThreadState *state, void *a, gboolean *stop)
 
 	/* Add the number of pixels we've just allocated to progress.
 	 */
-	sink_base->processed += state->pos.width * state->pos.height;
+	sink_base->processed += (guint64) state->pos.width * state->pos.height;
 
 	return 0;
 }
diff --git a/libvips/iofuncs/sinkdisc.c b/libvips/iofuncs/sinkdisc.c
@@ -419,7 +419,7 @@ wbuffer_allocate_fn(VipsThreadState *state, void *a, gboolean *stop)
 
 	/* Add the number of pixels we've just allocated to progress.
 	 */
-	sink_base->processed += state->pos.width * state->pos.height;
+	sink_base->processed += (guint64) state->pos.width * state->pos.height;
 
 	return 0;
 }
diff --git a/libvips/iofuncs/sinkmemory.c b/libvips/iofuncs/sinkmemory.c
@@ -244,7 +244,7 @@ sink_memory_area_allocate_fn(VipsThreadState *state, void *a, gboolean *stop)
 
 	/* Add the number of pixels we've just allocated to progress.
 	 */
-	sink_base->processed += state->pos.width * state->pos.height;
+	sink_base->processed += (guint64) state->pos.width * state->pos.height;
 
 	return 0;
 }
diff --git a/libvips/iofuncs/type.c b/libvips/iofuncs/type.c
@@ -198,14 +198,14 @@ vips_area_unref(VipsArea *area)
 
 		VIPS_FREEF(vips_g_mutex_free, area->lock);
 
-		g_free(area);
-
 		if (vips__leak) {
 			g_mutex_lock(&vips__global_lock);
 			vips_area_all = g_slist_remove(vips_area_all, area);
 			g_mutex_unlock(&vips__global_lock);
 		}
 
+		g_free(area);
+
 #ifdef DEBUG
 		g_mutex_lock(&vips__global_lock);
 		printf("vips_area_unref: free .. total = %d\n",
diff --git a/libvips/mosaicing/matrixinvert.c b/libvips/mosaicing/matrixinvert.c
@@ -129,7 +129,7 @@ lu_decomp(VipsImage *mat)
 
 	/* copy all coefficients and then perform decomposition in-place */
 	memcpy(VIPS_MATRIX(lu, 0, 0), VIPS_MATRIX(mat, 0, 0),
-		mat->Xsize * mat->Xsize * sizeof(double));
+		(size_t) mat->Xsize * mat->Xsize * sizeof(double));
 
 	for (i = 0; i < mat->Xsize; ++i) {
 		row_scale[i] = 0.0;
diff --git a/test/test_timeout_gifsave.c b/test/test_timeout_gifsave.c
@@ -18,7 +18,6 @@ main(int argc, char **argv)
 	void *buf;
 	size_t len;
 	gboolean is_killed = FALSE;
-	int ret;
 
 	if (VIPS_INIT(argv[0]))
 		vips_error_exit(NULL);
@@ -36,14 +35,13 @@ main(int argc, char **argv)
 		G_CALLBACK(eval_callback), &is_killed);
 
 	buf = NULL;
-	ret = vips_gifsave_buffer(im, &buf, &len, NULL);
-	if (!ret)
-		printf("expected error return from vips_gifsave_buffer()\n");
+	if (vips_gifsave_buffer(im, &buf, &len, NULL))
+		printf("error return from vips_gifsave_buffer()\n");
 
 	g_object_unref(im);
 	if (buf)
 		g_free(buf);
 	g_assert(is_killed);
 
-	return !ret;
+	return 0;
 }

Original file line number	Diff line number	Diff line change
`@@ -117,8 +117,8 @@ histogram_new(VipsHistFindIndexed *indexed)`
`117`	`117`	`!(hist->reg = vips_region_new(indexed->index_ready)))`
`118`	`118`	`return NULL;`
`119`	`119`
`120`		`- memset(hist->bins, 0, bands * hist->size * sizeof(double));`
`121`		`- memset(hist->init, 0, hist->size * sizeof(int));`
	`120`	`+ memset(hist->bins, 0, (size_t) bands * hist->size * sizeof(double));`
	`121`	`+ memset(hist->init, 0, (size_t) hist->size * sizeof(int));`
`122`	`122`
`123`	`123`	`return hist;`
`124`	`124`	`}`
Original file line number	Diff line number	Diff line change
`@@ -109,8 +109,8 @@ histogram_new(VipsProject *project)`
`109`	`109`	`!hist->row_sums)`
`110`	`110`	`return NULL;`
`111`	`111`
`112`		`- memset(hist->column_sums, 0, psize * in->Xsize);`
`113`		`- memset(hist->row_sums, 0, psize * in->Ysize);`
	`112`	`+ memset(hist->column_sums, 0, (size_t) psize * in->Xsize);`
	`113`	`+ memset(hist->row_sums, 0, (size_t) psize * in->Ysize);`
`114`	`114`
`115`	`115`	`return hist;`
`116`	`116`	`}`
Original file line number	Diff line number	Diff line change
`@@ -96,7 +96,7 @@ vips_bandfold_gen(VipsRegion *out_region,`
`96`	`96`	`/* We can't use vips_region_region() since we change pixel`
`97`	`97`	`* coordinates.`
`98`	`98`	`*/`
`99`		`- memcpy(q, p, psize * r->width);`
	`99`	`+ memcpy(q, p, (size_t) psize * r->width);`
`100`	`100`	`}`
`101`	`101`
`102`	`102`	`return 0;`
Original file line number	Diff line number	Diff line change
`@@ -99,7 +99,7 @@ vips_bandunfold_gen(VipsRegion *out_region,`
`99`	`99`	`/* We can't use vips_region_region() since we change pixel`
`100`	`100`	`* coordinates.`
`101`	`101`	`*/`
`102`		`- memcpy(q, p, r->width * psize);`
	`102`	`+ memcpy(q, p, (size_t) r->width * psize);`
`103`	`103`	`}`
`104`	`104`
`105`	`105`	`return 0;`
Original file line number	Diff line number	Diff line change
`@@ -217,7 +217,7 @@ vips_embed_base_paint_edge(VipsEmbedBase *base,`
`217`	`217`	`*/`
`218`	`218`	`for (y = 0; y < todo.height; y++) {`
`219`	`219`	`q = VIPS_REGION_ADDR(out_region, todo.left, todo.top + y);`
`220`		`- memcpy(q, p, bs * todo.width);`
	`220`	`+ memcpy(q, p, (size_t) bs * todo.width);`
`221`	`221`	`}`
`222`	`222`	`}`
`223`	`223`