Bug 1652622

Created attachment 1507951 [details]
./img2txt POC1

version: libcaca0.99beta19
Summary: 

There is an illegal READ memory access at caca/dither.c:1347 (function:get_rgba_default )in libcaca latest version.

Description:

The asan debug is as follows:

$./img2txt POC1

=================================================================
==28249==ERROR: AddressSanitizer: SEGV on unknown address 0x7f88ae6a7004 (pc 0x7f88b2b37857 bp 0x000000000042 sp 0x7ffe82454ed0 T0)
==28249==The signal is caused by a READ memory access.
    #0 0x7f88b2b37856 in get_rgba_default /home/company/real/libcaca-master/caca/dither.c:1347
    #1 0x7f88b2b3aa16 in caca_dither_bitmap /home/company/real/libcaca-master/caca/dither.c:1009
    #2 0x55688cdba96e in main /home/company/real/libcaca-master/src/img2txt.c:210
    #3 0x7f88b27581c0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x211c0)
    #4 0x55688cdbaf09 in _start (/home/company/real/libcaca-master/install_asan/bin/img2txt+0x2f09)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/company/real/libcaca-master/caca/dither.c:1347 in get_rgba_default
==28249==ABORTING






 static void get_rgba_default(caca_dither_t const *d, uint8_t const *pixels,
1313                              int x, int y, unsigned int *rgba)
1314 {
1315     uint32_t bits;
1316 
1317     pixels += (d->bpp / 8) * x + d->pitch * y;
1318 
1319     switch(d->bpp / 8)
1320     {
1321         case 4:
1322             bits = *(uint32_t const *)pixels;
1323             break;
1324         case 3:
1325         {
1326 #if defined(HAVE_ENDIAN_H)
1327             if(__BYTE_ORDER == __BIG_ENDIAN)
1328 #else
1329             /* This is compile-time optimised with at least -O1 or -Os */
1330             uint32_t const tmp = 0x12345678;
1331             if(*(uint8_t const *)&tmp == 0x12)
1332 #endif
1333                 bits = ((uint32_t)pixels[0] << 16) |
1334                        ((uint32_t)pixels[1] << 8) |
1335                        ((uint32_t)pixels[2]);
1336             else
1337                 bits = ((uint32_t)pixels[2] << 16) |   //illegal READ memory access
1338                        ((uint32_t)pixels[1] << 8) |
1339                        ((uint32_t)pixels[0]);
1340             break;
1341         }
1342         case 2:
1343             bits = *(uint16_t const *)pixels;
1344             break;
1345         case 1:
1346         default:
1347             bits = pixels[0];    // illegal READ memory access
1348             break;
1349     }
1350 
1351     if(d->has_palette)