From 76291eb59a14b2b9e90ea5b056dc3f59e1c340b6 Mon Sep 17 00:00:00 2001 From: Samuel Gaist Date: Sat, 24 May 2025 21:07:37 +0200 Subject: [PATCH] [PATCH] Add clamping to QColorTransferGenericFunction This ensures that the inputs are within range for the use of these function. Depending on the values passed, they can trigger FE_INVALID errors and thus NaN as return values. This can happen for example when feeding an invalid ICC profile to QColorSpace::fromIccProfile. Credit to OSS-Fuzz Fixes: QTBUG-137159 Origin: upstream, https://download.qt.io/official_releases/qt/6.8/CVE-2025-5992-qtbase-6.8.patch Gbp-Pq: Name upstream_cve-2025-5992_input_range_qcolortransformation.diff --- src/gui/painting/qcolortransfergeneric_p.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/gui/painting/qcolortransfergeneric_p.h b/src/gui/painting/qcolortransfergeneric_p.h index f9052509..69836517 100644 --- a/src/gui/painting/qcolortransfergeneric_p.h +++ b/src/gui/painting/qcolortransfergeneric_p.h @@ -66,6 +66,7 @@ private: // HLG from linear [0-12] -> [0-1] static float hlgFromLinear(float x) { + x = std::clamp(x, 0.f, 12.f); if (x > 1.f) return m_hlg_a * std::log(x - m_hlg_b) + m_hlg_c; return std::sqrt(x * 0.25f); @@ -74,6 +75,7 @@ private: // HLG to linear [0-1] -> [0-12] static float hlgToLinear(float x) { + x = std::clamp(x, 0.f, 1.f); if (x < 0.5f) return (x * x) * 4.f; return std::exp((x - m_hlg_c) / m_hlg_a) + m_hlg_b; @@ -87,6 +89,7 @@ private: // PQ to linear [0-1] -> [0-64] static float pqToLinear(float e) { + e = std::clamp(e, 0.f, 1.f); // m2-th root of E' const float eRoot = std::pow(e, 1.f / m_pq_m2); // rational transform @@ -100,6 +103,7 @@ private: // PQ from linear [0-64] -> [0-1] static float pqFromLinear(float fd) { + fd = std::clamp(fd, 0.f, 64.f); // scale Fd to Y const float y = fd * (1.f / m_pq_f); // yRoot = Y^m1 -- "root" because m1 is <1 -- 2.30.2