fix a fence post error validating a combing mode number

[imager.git] / Changes

diff --git a/Changes b/Changes
index b153ca02f0a90e394e2581ee3fc1e3eb5d319fc1..d073d7fd4791cd41936c66683483dce6d7db30b2 100644 (file)
--- a/Changes
+++ b/Changes
@@ -5,6 +5,50 @@ Coverity finally finished a build, fix a few problems:
  - reading a color-mapped TGA file with an id string would cause a
    double-free if the palette was truncated.
 
+ - mixing scaling to sizes where the accumulator row, the working
+   output row or the working input row didn't fit into the address
+   space could result in memory leaks.  This can probably only be
+   reproduced on very wide floating-point sample images.
+
+ - convert an array style function parameter pointer to pointer style
+   to prevent confusing Coverity in the T1 bounding box implementation.
+
+ - Similarly in the FT1 bounding box implementation.
+
+ - Similarly for the i_tt_rasterize() function in the FT1
+   implementation.
+
+ - initialize a pointer to prevent Coverity complaining in polygon
+   drawing (it should always end up being set.)
+
+ - addi style makemap could potentially read one past the end of an
+   array.
+
+ - supplying a numeric hatch of 32 to Imager::Fill->new(hatch => ...)
+   would result in read beyond the end of the built-in hatch array.
+   Negative values (which Coverity didn't complain about) could also
+   cause problems.
+
+ - the Imager::Color set_internal() interal method no longer
+   calls the over-complicated ICL_set_internal() (which is retained
+   only for the old API.)  Coverity complained that this leaked, but
+   this could only occur with an invalid (NULL pointer) color object.
+
+ - the underlying implementation of the map() method could read before
+   the beginning on an allocated array if supplied with inconsistent
+   parameters, which Coverity complained about.  No Imager code calls
+   that function with inconsistent parameters, but a
+   belt-and-suspenders check was added.
+
+ - Coverity complained a call to i_getcolors(), used by the
+   implementation of the is_bilevel() method could leave the fetched
+   colors uninitialized.  Added a return value check.
+
+ - a numeric combining mode of 13 (eg. as a parameter to
+   Imager::Fill->new())could cause an invalid array read in
+   i_get_combine() due to a fencepost error in validating the combine
+   number.
+
 Imager 1.008 - 31 Dec 2018
 ============