Blob Blame History Raw
Fix buffer overflow reported in RHBZ #1897485.

When char is signed, casting to a (signed) int directly could produce a
negative offset into the ASCII lookup table; adding an intermediate cast to uch
(a typedef for unsigned char) ensures a nonnegative offset no greater than 255,
which always corresponds to a valid table index.

diff -Naur pngcheck-2.4.0-original/pngcheck.c pngcheck-2.4.0/pngcheck.c
--- pngcheck-2.4.0-original/pngcheck.c	2020-10-31 14:59:48.000000000 -0400
+++ pngcheck-2.4.0/pngcheck.c	2020-11-13 09:51:34.834858819 -0500
@@ -4926,8 +4926,10 @@
 /* GRR 20061203:  now EBCDIC-safe */
 int check_chunk_name(char *chunk_name, char *fname)
 {
-  if (isASCIIalpha((int)chunk_name[0]) && isASCIIalpha((int)chunk_name[1]) &&
-      isASCIIalpha((int)chunk_name[2]) && isASCIIalpha((int)chunk_name[3]))
+  if (isASCIIalpha((int)(uch)chunk_name[0]) &&
+      isASCIIalpha((int)(uch)chunk_name[1]) &&
+      isASCIIalpha((int)(uch)chunk_name[2]) &&
+      isASCIIalpha((int)(uch)chunk_name[3]))
     return 0;
 
   printf("%s%s  invalid chunk name \"%.*s\" (%02x %02x %02x %02x)\n",