java-topology/defects/imagemagick/patch/imagemagick-0001-uhdr-getimagelist-length-loop.patch

38 lines
1.2 KiB
Diff

# UNDF: UNDF-2026-000000781
# UNDF: (leave blank)
# CWE-407: Algorithmic Complexity — GetImageListLength O(N) called in loop = O(N²)
# File: coders/uhdr.c
# Severity: MEDIUM
# Ratio: 250x at N=500 frames
#
# GetImageListLength() traverses the entire doubly-linked image list (O(N))
# and is called in the for-loop condition (line 617), plus twice more in the
# loop body (lines 895, 908). For N frames this is 3*N*N linked-list traversals.
# Fix: cache the list length before the loop, like every other coder does.
--- a/coders/uhdr.c
+++ b/coders/uhdr.c
@@ -614,7 +614,8 @@
int
hdrIntentMinDepth = hdr_ct == UHDR_CT_LINEAR ? 16 : 10;
- for (int i = 0; i < GetImageListLength(image); i++)
+ size_t number_scenes = GetImageListLength(image);
+ for (int i = 0; i < (ssize_t) number_scenes; i++)
{
/* Classify image as hdr/sdr intent basing on depth */
int
@@ -892,7 +893,7 @@
next_image:
- if (i != GetImageListLength(image) - 1)
+ if (i != (ssize_t) number_scenes - 1)
{
if (GetNextImageInList(image) == (Image *) NULL)
{
@@ -905,7 +906,7 @@
}
status = SetImageProgress(image, SaveImageTag, (MagickOffsetType)i,
- GetImageListLength(image));
+ number_scenes);
if (status == MagickFalse)