coverity complained minset could be -1

but no callers call i_map() in such a way that it can happen.

Add a belt-and-suspenders check.

diff --git a/Changes b/Changes
index e115b31b5efaf6835b10f3cb129834f309fbe627..2554022b03ce0bdd9bb11773a4ca721208862ccf 100644 (file)
--- a/Changes
+++ b/Changes
@@ -31,6 +31,12 @@ Coverity finally finished a build, fix a few problems:
    only for the old API.)  Coverity complained that this leaked, but
    this could only occur with an invalid (NULL pointer) color object.
 
+ - the underlying implementation of the map() method could read before
+   the beginning on an allocated array if supplied with inconsistent
+   parameters, which Coverity complained about.  No Imager code calls
+   that function with inconsistent parameters, but a
+   belt-and-suspenders check was added.
+
 Imager 1.008 - 31 Dec 2018
 ============
 

diff --git a/map.c b/map.c
index 0431367f5b0613e85de9433162e70072aeb60f64..aedd0dffd230307ff240635a39d90bfe70ff074e 100644 (file)
--- a/map.c
+++ b/map.c
@@ -45,14 +45,18 @@ i_map(i_img *im, unsigned char (*maps)[256], unsigned int mask) {
 
   if (!mask) return; /* nothing to do here */
 
-  for(i=0; i<im->channels; i++)
+  for(i=0; i<im->channels; i++) {
     if (mask & (1<<i)) {
       if (minset == -1) minset = i;
       maxset = i;
     }
+  }
 
   mm_log((1, "minset=%d maxset=%d\n", minset, maxset));
 
+  if (minset == -1)
+    return;
+
   vals = mymalloc(sizeof(i_color) * im->xsize);
 
   for (y = 0; y < im->ysize; ++y) {

diff --git a/t/300-transform/060-map.t b/t/300-transform/060-map.t
index ace95218dbf40aadcdd9aa62bfabbe28965d9713..d8d8a18f93ce7b07cf84340fa5a053c7eaee7e09 100644 (file)
--- a/t/300-transform/060-map.t
+++ b/t/300-transform/060-map.t
@@ -1,7 +1,7 @@
 #!perl -w
 use strict;
-use Test::More tests => 10;
-use Imager::Test qw(is_image);
+use Test::More;
+use Imager::Test qw(is_image test_image);
 
 -d "testout" or mkdir "testout";
 
@@ -61,3 +61,16 @@ SKIP: {
   ok($out, "map()");
   is_image($out, $cmp, "test map output");
 }
+
+{
+  # test with zero mask: coverity detected a bad channel index problem
+  # that only applies in this case
+  my $im = test_image();
+  $im->setmask(mask => 0x80);
+  is($im->getmask, 0x80, "check we set mask");
+  my @map = ( map int $_ / 2, 0 .. 255 );
+  my $out = $im->map(maps => [ (undef) x 3 ]);
+  ok($out, "map done");
+}
+
+done_testing();