[PATCH 0/1] MR9343: windowscodecs: Fix potential integer overflow in PNG format reader

[Wei Xie (＠wayne)]

Fixed a potential integer overflow issue in the read_ulong_be function
by adding an explicit cast to ULONG before bit shifting. The data[0]
byte was being shifted left 24 bits without proper casting, which could
cause overflow when the byte value is large and the compiler treats it
as a signed char. This ensures proper 32-bit unsigned integer behavior
during the bitwise OR operations.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9343

[PATCH 1/1] windowscodecs: Fix potential integer overflow in PNG format reader

[Wei Xie]

From: Wei Xie <xiewei(a)uniontech.com>

Fixed a potential integer overflow issue in the read_ulong_be function
by adding an explicit cast to ULONG before bit shifting. The data[0]
byte was being shifted left 24 bits without proper casting, which could
cause overflow when the byte value is large and the compiler treats it
as a signed char. This ensures proper 32-bit unsigned integer behavior
during the bitwise OR operations.
---
 dlls/windowscodecs/pngformat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/windowscodecs/pngformat.c b/dlls/windowscodecs/pngformat.c
index 77bfbdc4866..4e4677820eb 100644
--- a/dlls/windowscodecs/pngformat.c
+++ b/dlls/windowscodecs/pngformat.c
@@ -37,7 +37,7 @@ static inline USHORT read_ushort_be(BYTE* data)
 
 static inline ULONG read_ulong_be(BYTE* data)
 {
-    return data[0] << 24 | data[1] << 16 | data[2] << 8 | data[3];
+    return ((ULONG)data[0] << 24) | data[1] << 16 | data[2] << 8 | data[3];
 }
 
 static HRESULT LoadTextMetadata(MetadataHandler *handler, IStream *stream, const GUID *preferred_vendor,
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/9343

[Alfred Agrell (＠Alcaro)]

[But BYTE is explicitly unsigned?](https://learn.microsoft.com/en-us/windows/win32/winprog/windows-data-types)

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9343#note_120429

[Alfred Agrell (＠Alcaro)]

On Mon Nov  3 07:40:22 2025 +0000, Alfred Agrell wrote:
> [But BYTE is explicitly unsigned?](https://learn.microsoft.com/en-us/windows/win32/winprog/windows-data-types)
> Wait, you're right, bitshifting an unsigned char promotes to signed int. Signed char is irrelevant, but the patch is correct.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9343#note_120430

[PATCH 0/1] MR9343: windowscodecs: Fix potential integer overflow in PNG format reader - approved

[Esme Povirk (＠madewokherd)]

This merge request was approved by Esme Povirk.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9343