From 1d7bf858778f816d233de8d1e4ecb81b5ca840ea Mon Sep 17 00:00:00 2001 From: Fabian Giesen Date: Fri, 2 Jul 2021 18:28:41 -0700 Subject: [PATCH] stb_image: Fix lrot definition, small extend_receive tweak Define lrot in a way that doesn't involve UB when n==0. Also, the previous patch ensures that n <= 15 for all callers of stbi__extend_receive, so can remove the (less restrictive) bounds check for 0 <= n < 17 (the bounds of stbi__bmask) entirely. Fixes issue #1065. --- stb_image.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/stb_image.h b/stb_image.h index 2fced29..13f9f12 100644 --- a/stb_image.h +++ b/stb_image.h @@ -645,7 +645,7 @@ typedef unsigned char validate_uint32[sizeof(stbi__uint32)==4 ? 1 : -1]; #ifdef STBI_HAS_LROTL #define stbi_lrot(x,y) _lrotl(x,y) #else - #define stbi_lrot(x,y) (((x) << (y)) | ((x) >> (32 - (y)))) + #define stbi_lrot(x,y) (((x) << (y)) | ((x) >> (-(y) & 31))) #endif #if defined(STBI_MALLOC) && defined(STBI_FREE) && (defined(STBI_REALLOC) || defined(STBI_REALLOC_SIZED)) @@ -2104,7 +2104,6 @@ stbi_inline static int stbi__extend_receive(stbi__jpeg *j, int n) sgn = (stbi__int32)j->code_buffer >> 31; // sign bit is always in MSB k = stbi_lrot(j->code_buffer, n); - if (n < 0 || n >= (int) (sizeof(stbi__bmask)/sizeof(*stbi__bmask))) return 0; j->code_buffer = k & ~stbi__bmask[n]; k &= stbi__bmask[n]; j->code_bits -= n;