Add clamping to QColorTransferGenericFunction

This ensures that the inputs are within range for the use of these
function.

Depending on the values passed, they can trigger FE_INVALID errors
and thus NaN as return values.

This can happen for example when feeding an invalid ICC profile to
QColorSpace::fromIccProfile.

Credit to OSS-Fuzz

Fixes: QTBUG-137159
Pick-to: 6.8 6.5
Change-Id: I435a5768fbb7d3e6cb84d578703e7dde2e39a27e
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
(cherry picked from commit f12d046383decf8f468de62732c9cff7d4303cbf)
Reviewed-by: Qt Cherry-pick Bot <[email protected]>
(cherry picked from commit 8706176f8f78df9bf5cc560fb80aefa3fda01d98)

1 files changed, 4 insertions, 0 deletions

diff --git a/src/gui/painting/qcolortransfergeneric_p.h b/src/gui/painting/qcolortransfergeneric_p.h
index 6caebceb1a4..c2ebd937a44 100644
--- a/src/gui/painting/qcolortransfergeneric_p.h
+++ b/src/gui/painting/qcolortransfergeneric_p.h
@@ -65,6 +65,7 @@ private:
     // HLG from linear [0-12] -> [0-1]
     static float hlgFromLinear(float x)
     {
+        x = std::clamp(x, 0.f, 12.f);
         if (x > 1.f)
             return m_hlg_a * std::log(x - m_hlg_b) + m_hlg_c;
         return std::sqrt(x * 0.25f);
@@ -73,6 +74,7 @@ private:
     // HLG to linear [0-1] -> [0-12]
     static float hlgToLinear(float x)
     {
+        x = std::clamp(x, 0.f, 1.f);
         if (x < 0.5f)
             return (x * x) * 4.f;
         return std::exp((x - m_hlg_c) / m_hlg_a) + m_hlg_b;
@@ -86,6 +88,7 @@ private:
     // PQ to linear [0-1] -> [0-64]
     static float pqToLinear(float e)
     {
+        e = std::clamp(e, 0.f, 1.f);
         // m2-th root of E'
         const float eRoot = std::pow(e, 1.f / m_pq_m2);
         // rational transform
@@ -99,6 +102,7 @@ private:
     // PQ from linear [0-64] -> [0-1]
     static float pqFromLinear(float fd)
     {
+        fd = std::clamp(fd, 0.f, 64.f);
         // scale Fd to Y
         const float y = fd * (1.f / m_pq_f);
         // yRoot = Y^m1 -- "root" because m1 is <1