qpl icon indicating copy to clipboard operation
qpl copied to clipboard

qpl/sources/middle-layer/compression/deflate/containers /huffman_table.cpp: Potential Integer Overflow

Open stasos24 opened this issue 10 months ago • 1 comments

Case 1

Since

fixed_codes[i].length is unt8_t

and

ll_histogram[i] is unt32_t

There is could be possible integer overflow at:

https://github.com/intel/qpl/blob/d08be0031eb5741ee1372651ba52a671308bb296/sources/middle-layer/compression/deflate/containers/huffman_table.cpp#L134

Possible fix:

static_cast<uint64_t>(ll_codes[i].length) * ll_histogram[i];

Case 2

Since

buffer_used(bit_buffer) + bit_buffer->m_bit_count - are unit32_t

at https://github.com/intel/qpl/blob/d08be0031eb5741ee1372651ba52a671308bb296/sources/middle-layer/compression/deflate/containers/huffman_table.cpp#L164

it would be better to cast one of them to uint64_t because compressed_len is uint64_t

stasos24 avatar Mar 04 '25 17:03 stasos24

Thanks for pointing this out! We'll take a look and I'll let you know once this is addressed.

mzhukova avatar Mar 07 '25 19:03 mzhukova