From f4822eec1855231f189e5348dffc29299f6edf93 Mon Sep 17 00:00:00 2001 From: Samuel Gaist Date: Sat, 24 May 2025 21:07:37 +0200 Subject: [PATCH] Add clamping to QColorTransferGenericFunction This ensures that the inputs are within range for the use of these function. Depending on the values passed, they can trigger FE_INVALID errors and thus NaN as return values. This can happen for example when feeding an invalid ICC profile to QColorSpace::fromIccProfile. Credit to OSS-Fuzz Fixes: QTBUG-137159 Pick-to: 6.8 6.5 Change-Id: I435a5768fbb7d3e6cb84d578703e7dde2e39a27e Reviewed-by: Allan Sandfeld Jensen (cherry picked from commit f12d046383decf8f468de62732c9cff7d4303cbf) Reviewed-by: Qt Cherry-pick Bot (cherry picked from commit 8706176f8f78df9bf5cc560fb80aefa3fda01d98) --- src/gui/painting/qcolortransfergeneric_p.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/gui/painting/qcolortransfergeneric_p.h b/src/gui/painting/qcolortransfergeneric_p.h index 6caebceb1a4..c2ebd937a44 100644 --- a/src/gui/painting/qcolortransfergeneric_p.h +++ b/src/gui/painting/qcolortransfergeneric_p.h @@ -65,6 +65,7 @@ private: // HLG from linear [0-12] -> [0-1] static float hlgFromLinear(float x) { + x = std::clamp(x, 0.f, 12.f); if (x > 1.f) return m_hlg_a * std::log(x - m_hlg_b) + m_hlg_c; return std::sqrt(x * 0.25f); @@ -73,6 +74,7 @@ private: // HLG to linear [0-1] -> [0-12] static float hlgToLinear(float x) { + x = std::clamp(x, 0.f, 1.f); if (x < 0.5f) return (x * x) * 4.f; return std::exp((x - m_hlg_c) / m_hlg_a) + m_hlg_b; @@ -86,6 +88,7 @@ private: // PQ to linear [0-1] -> [0-64] static float pqToLinear(float e) { + e = std::clamp(e, 0.f, 1.f); // m2-th root of E' const float eRoot = std::pow(e, 1.f / m_pq_m2); // rational transform @@ -99,6 +102,7 @@ private: // PQ from linear [0-64] -> [0-1] static float pqFromLinear(float fd) { + fd = std::clamp(fd, 0.f, 64.f); // scale Fd to Y const float y = fd * (1.f / m_pq_f); // yRoot = Y^m1 -- "root" because m1 is <1 -- 2.50.0