Fix buffer overflow reported in RHBZ #1897485.
When char is signed, casting to a (signed) int directly could produce a
negative offset into the ASCII lookup table; adding an intermediate cast to uch
(a typedef for unsigned char) ensures a nonnegative offset no greater than 255,
which always corresponds to a valid table index.
diff -Naur pngcheck-2.4.0-original/pngcheck.c pngcheck-2.4.0/pngcheck.c
--- pngcheck-2.4.0-original/pngcheck.c 2020-10-31 14:59:48.000000000 -0400
+++ pngcheck-2.4.0/pngcheck.c 2020-11-13 09:51:34.834858819 -0500
@@ -4926,8 +4926,10 @@
/* GRR 20061203: now EBCDIC-safe */
int check_chunk_name(char *chunk_name, char *fname)
{
- if (isASCIIalpha((int)chunk_name[0]) && isASCIIalpha((int)chunk_name[1]) &&
- isASCIIalpha((int)chunk_name[2]) && isASCIIalpha((int)chunk_name[3]))
+ if (isASCIIalpha((int)(uch)chunk_name[0]) &&
+ isASCIIalpha((int)(uch)chunk_name[1]) &&
+ isASCIIalpha((int)(uch)chunk_name[2]) &&
+ isASCIIalpha((int)(uch)chunk_name[3]))
return 0;
printf("%s%s invalid chunk name \"%.*s\" (%02x %02x %02x %02x)\n",