From c3a91c3bc62bdd913c55dd83f4e1159ed25310c5 Mon Sep 17 00:00:00 2001
From: Mirco Miranda <mirco.miranda@systemceramics.com>
Date: Sun, 16 Jul 2023 08:03:58 +0000
Subject: [PATCH] psd: Fix UB type punning

BUGS: 471829
---
 src/imageformats/psd.cpp | 33 ++++++++++++++++++++++++++-------
 1 file changed, 26 insertions(+), 7 deletions(-)

diff --git a/src/imageformats/psd.cpp b/src/imageformats/psd.cpp
index 7280aea..b0c76e2 100644
--- a/src/imageformats/psd.cpp
+++ b/src/imageformats/psd.cpp
@@ -42,6 +42,7 @@
 #include <QColorSpace>
 
 #include <cmath>
+#include <cstring>
 
 typedef quint32 uint;
 typedef quint16 ushort;
@@ -808,6 +809,26 @@ inline quint32 xchg(quint32 v) {
 #endif
 }
 
+inline float xchg(float v)
+{
+#if Q_BYTE_ORDER == Q_LITTLE_ENDIAN
+#   ifdef Q_CC_MSVC
+    float *pf = &v;
+    quint32 f = xchg(*reinterpret_cast<quint32*>(pf));
+    quint32 *pi = &f;
+    return *reinterpret_cast<float*>(pi);
+#   else
+    quint32 t;
+    std::memcpy(&t, &v, sizeof(quint32));
+    t = xchg(t);
+    std::memcpy(&v, &t, sizeof(quint32));
+    return v;
+#   endif
+#else
+    return v;  // never tested
+#endif
+}
+
 template<class T>
 inline void planarToChunchy(uchar *target, const char *source, qint32 width, qint32 c, qint32 cn)
 {
@@ -818,15 +839,13 @@ inline void planarToChunchy(uchar *target, const char *source, qint32 width, qin
     }
 }
 
-template<class T, T min = 0, T max = 1>
-inline void planarToChunchyFloat(uchar *target, const char *source, qint32 width, qint32 c, qint32 cn)
+template<class T>
+inline void planarToChunchyFloatToUInt16(uchar *target, const char *source, qint32 width, qint32 c, qint32 cn)
 {
     auto s = reinterpret_cast<const T*>(source);
     auto t = reinterpret_cast<quint16*>(target);
     for (qint32 x = 0; x < width; ++x) {
-        auto tmp = xchg(s[x]);
-        auto ftmp = (*reinterpret_cast<float*>(&tmp) - double(min)) / (double(max) - double(min));
-        t[x * cn + c] = quint16(std::min(ftmp * std::numeric_limits<quint16>::max() + 0.5, double(std::numeric_limits<quint16>::max())));
+        t[x * cn + c] = quint16(std::min(xchg(s[x]) * std::numeric_limits<quint16>::max() + 0.5, double(std::numeric_limits<quint16>::max())));
     }
 }
 
@@ -1140,7 +1159,7 @@ static bool LoadPSD(QDataStream &stream, const PSDHeader &header, QImage &img)
                 } else if (header.depth == 16) {
                     planarToChunchy<quint16>(scanLine, rawStride.data(), header.width, c, header.channel_count);
                 } else if (header.depth == 32) {
-                    planarToChunchyFloat<quint32>(scanLine, rawStride.data(), header.width, c, header.channel_count);
+                    planarToChunchyFloatToUInt16<float>(scanLine, rawStride.data(), header.width, c, header.channel_count);
                 }
             }
 
@@ -1204,7 +1223,7 @@ static bool LoadPSD(QDataStream &stream, const PSDHeader &header, QImage &img)
                 } else if (header.depth == 16) { // 16-bits integer images: Grayscale, RGB/RGBA
                     planarToChunchy<quint16>(scanLine, rawStride.data(), header.width, c, imgChannels);
                 } else if (header.depth == 32) { // 32-bits float images: Grayscale, RGB/RGBA (coverted to equivalent integer 16-bits)
-                    planarToChunchyFloat<quint32>(scanLine, rawStride.data(), header.width, c, imgChannels);
+                    planarToChunchyFloatToUInt16<float>(scanLine, rawStride.data(), header.width, c, imgChannels);
                 }
             }
         }
-- 
GitLab