[Anonymous]

The code in pngimage.c, create_soft_mask(...) assumes the data stream containing the palette index bytes is 8 bits-per-color (-index).

  for (i = 0; i < width*height; i++) {
    png_byte idx = image_data_ptr[i];
    smask_data_ptr[i] = (idx < num_trans) ? trans[idx] : 0xff;
  }

This accesses the wrong data, the block should read

png_byte mask = 0xff >> (8 - bpc);
for (i = 0; i < width*height; i++) {
    /* data is packed for 1/2/4 bpc formats, msb first */
    png_byte idx = (image_data_ptr[bpc * i / 8] >> (3 - bpc * i % 8)) & mask;
    smask_data_ptr[i] = (idx < num_trans) ? trans[idx] : 0xff;
}

[Anonymous]

Affected PNG, SMask is wrong, xetex occasionaly crashes (OOB access of image_data_ptr)

[Anonymous]

png_byte shift = (8 / bpc) - 1;
png_byte idx = (image_data_ptr[bpc * i / 8] >> (shift - bpc * i % 8)) & mask;

[Dr. Werner Fink]

I've received the attached patch from a bug report of Stefan Brüns stefan.bruens@rwth-aachen.de for TeXLive which may solve the bug

[Stefan Brüns]

The "shift" above was still wrong, in the attached patch it is correct (i.e. shift = 8 - bpc).

[Akira Kakuto]

Applied the patch by Stefan for dvipdfm-x in TeX Live SVN: r47469.

[Dr. Werner Fink]

This one seems to be missed in texlive-20180414-source.tar.xz

On Mon, Apr 30, 2018 at 03:36:14AM +0000, Akira Kakuto wrote:

Applied the patch by Stefan for dvipdfm-x in TeX Live SVN: r47469.

---

[bugs:#151] Segfault with 1/2/4-bit transparent indexed PNGs

Status: open
Group: Future
Created: Fri Apr 27, 2018 12:12 AM UTC by Anonymous
Last Updated: Fri Apr 27, 2018 12:53 PM UTC
Owner: nobody

The code in pngimage.c, create_soft_mask(...) assumes the data stream containing the palette index bytes is 8 bits-per-color (-index).
~~~
for (i = 0; i < width*height; i++) {
png_byte idx = image_data_ptr[i];
smask_data_ptr[i] = (idx < num_trans) ? trans[idx] : 0xff;
}
~~~

This accesses the wrong data, the block should read
~~~
png_byte mask = 0xff >> (8 - bpc);
for (i = 0; i < widthheight; i++) {
/ data is packed for 1/2/4 bpc formats, msb first */
png_byte idx = (image_data_ptr[bpc * i / 8] >> (3 - bpc * i % 8)) & mask;
smask_data_ptr[i] = (idx < num_trans) ? trans[idx] : 0xff;
}
~~~

--
"Having a smoking section in a restaurant is like having
a peeing section in a swimming pool." -- Edward Burr

[Norbert Preining]

This one seems to be missed in texlive-20180414-source.tar.xz

Yes, because the sources are what made it into the released TL.

I am collecting patches (cherry-picking) in the tl2018-fixes branch at
https://github.com/TeX-Live/texlive-source/tree/tl2018-fixes

Norbert

--
PREINING Norbert http://www.preining.info
Accelia Inc. + JAIST + TeX Live + Debian Developer
GPG: 0x860CDC13 fp: F7D8 A928 26E3 16A1 9FA0 ACF0 6CAC A448 860C DC13

[Akira Kakuto]

This one seems to be missed in texlive-20180414-source.tar.xz

Applied the patch by Stefan for dvipdfm-x in TeX Live SVN: r47469.

Please note the date:
r47469 was done on 2018/04/28 after the release of TL2018.

Best,
Akira