Skip to content

string op overflow in src/switch_core_video.c #3040

@barf

Description

@barf

Describe the bug
overflow writing 1 byte into a region of size 0
included file libs/stb/stb_image.h throws compilation error using GCC 15

To Reproduce
Build v1.11.1

git clone -b v1.11.1 https://github.com/signalwire/freeswitch
./configure --enable-optimization --enable-systemd
make

Package version or git hash

  • v1.11.1

build output

$ make
make  all-recursive
make[1]: Entering directory '/home/barf/src/freeswitch'
  GEN      src/include/switch_private.h.in
  GEN      src/include/stamp-h1
config.status: creating src/include/switch_private.h
config.status: src/include/switch_private.h is unchanged
  CC       src/libfreeswitch_la-switch_version.lo
  CC       src/libfreeswitch_la-switch_core_video.lo
In file included from src/switch_core_video.c:52:
src/../libs/stb/stb_image.h: In function 'stbi__parse_png_file':
src/../libs/stb/stb_image.h:4963:56: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
 4963 |                   for (k = 0; k < s->img_n; ++k) tc[k] = (stbi_uc)(stbi__get16be(s) & 255) * stbi__depth_scale_table[z->depth]; // non 8-bit images will be larger
      |                                                  ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/../libs/stb/stb_image.h:4882:25: note: at offset 3 into destination object 'tc' of size 3
 4882 |    stbi_uc has_trans=0, tc[3]={0};
      |                         ^~
In function 'stbi__refill_buffer',
    inlined from 'stbi__get8' at src/../libs/stb/stb_image.h:1520:7,
    inlined from 'stbi__get8' at src/../libs/stb/stb_image.h:1515:28,
    inlined from 'stbi__hdr_test_core' at src/../libs/stb/stb_image.h:6794:11,
    inlined from 'stbi__hdr_test' at src/../libs/stb/stb_image.h:6805:12,
    inlined from 'stbi__hdr_test' at src/../libs/stb/stb_image.h:6800:12,
    inlined from 'stbi_is_hdr_from_memory' at src/../libs/stb/stb_image.h:1424:11:
src/../libs/stb/stb_image.h:1501:18: error: 's.io_user_data' may be used uninitialized [-Werror=maybe-uninitialized]
 1501 |    int n = (s->io.read)(s->io_user_data,(char*)s->buffer_start,s->buflen);
      |            ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/../libs/stb/stb_image.h: In function 'stbi_is_hdr_from_memory':
src/../libs/stb/stb_image.h:1422:18: note: 's' declared here
 1422 |    stbi__context s;
      |                  ^
In function 'stbi__refill_buffer',
    inlined from 'stbi__get8' at src/../libs/stb/stb_image.h:1520:7,
    inlined from 'stbi__get8' at src/../libs/stb/stb_image.h:1515:28,
    inlined from 'stbi__hdr_test_core' at src/../libs/stb/stb_image.h:6794:11,
    inlined from 'stbi__hdr_test' at src/../libs/stb/stb_image.h:6805:12,
    inlined from 'stbi__hdr_test' at src/../libs/stb/stb_image.h:6800:12,
    inlined from 'stbi_is_hdr_from_memory' at src/../libs/stb/stb_image.h:1424:11:
src/../libs/stb/stb_image.h:1501:18: error: 's.buflen' may be used uninitialized [-Werror=maybe-uninitialized]
 1501 |    int n = (s->io.read)(s->io_user_data,(char*)s->buffer_start,s->buflen);
      |            ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/../libs/stb/stb_image.h: In function 'stbi_is_hdr_from_memory':
src/../libs/stb/stb_image.h:1422:18: note: 's' declared here
 1422 |    stbi__context s;
      |                  ^
cc1: all warnings being treated as errors
make[1]: *** [Makefile:2498: src/libfreeswitch_la-switch_core_video.lo] Error 1
make[1]: Leaving directory '/home/barf/src/freeswitch'
make: *** [Makefile:1442: all] Error 2

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions