From: Florian Müllner <fmuellner@gnome.org>
Date: Thu, 22 Nov 2018 19:41:44 +0000 (+0100)
Subject: st: Avoid integer overflow on unpremultiply
X-Git-Tag: archive/raspbian/50.5-1+rpi1~1^2~897^2~1^2~18
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=925a25da17986bf60f61bb4e06ec22e2c59fa14f;p=gnome-shell.git

st: Avoid integer overflow on unpremultiply

When computing the effective border color, we operate on colors with
premultiplied alpha to simplify the calculations, then unpremultiply
the result. However we miss a bounds check in the last check, so any
color component can overflow the allowed maximum of 0xff and shift the
result in unexpected ways.

https://gitlab.gnome.org/GNOME/gnome-shell/merge_requests/305
---

diff --git a/src/st/st-theme-node-drawing.c b/src/st/st-theme-node-drawing.c
index 9f7e6b6ca..a7fb24ab8 100644
--- a/src/st/st-theme-node-drawing.c
+++ b/src/st/st-theme-node-drawing.c
@@ -229,9 +229,9 @@ unpremultiply (ClutterColor *color)
 {
   if (color->alpha != 0)
     {
-      color->red = (color->red * 255 + 127) / color->alpha;
-      color->green = (color->green * 255 + 127) / color->alpha;
-      color->blue = (color->blue * 255 + 127) / color->alpha;
+      color->red = MIN((color->red * 255 + 127) / color->alpha, 255);
+      color->green = MIN((color->green * 255 + 127) / color->alpha, 255);
+      color->blue = MIN((color->blue * 255 + 127) / color->alpha, 255);
     }
 }