search

juce-framework / JUCE

JUCE is an open-source cross-platform C++ application framework for desktop and mobile applications, including VST, VST3, AU, AUv3, LV2 and AAX audio plug-ins.
https://juce.com
Other
6.54k stars 1.73k forks source link

[Bug]: Pointer overflow in JUCE/modules/juce_graphics/images/juce_Image.h #1241

Open NickolayGerasimenko opened 1 year ago

NickolayGerasimenko commented 1 year ago

Detailed steps on how to reproduce the bug

Run any JUCE based app which is using class juce_Image under Xcode thread sanitizer(turn on undefined behaviour checkbox). Observe pointer overflow in function

inline uint8* getPixelPointer (int x, int y) const noexcept  { 
     return data + (size_t) y * (size_t) lineStride + (size_t) x * (size_t) pixelStride;
}
Screenshot 2023-06-22 at 14 35 58

What is the expected behaviour?

Proper uint64_t overflow check should be added https://codeql.github.com/codeql-query-help/cpp/cpp-pointer-overflow-check/

Operating systems

macOS

What versions of the operating systems?

OSX 12.6.6

Architectures

64-bit

Stacktrace

No response

Plug-in formats (if applicable)

No response

Plug-in host applications (DAWs) (if applicable)

No response

Testing on the develop branch

I have not tested against the develop branch

Code of Conduct

reuk commented 1 year ago

I'm unable to reproduce this issue using the develop branch, testing with the GraphicsDemo in the DemoRunner.

Please can you test out the develop branch and see whether the issue is fixed there? Thanks!

NickolayGerasimenko commented 1 year ago

@reuk thanks for quick reply. Don't see any diff in this line in compare to our version. https://github.com/juce-framework/JUCE/blob/develop/modules/juce_graphics/images/juce_Image.h#L334

so overflow is still there.

reuk commented 1 year ago

Did you try building and running from develop? It's possible that this function is no longer called at all with the combination of parameters that cause the problem. That is, a fix doesn't necessarily require changing that particular function.