/ 
Imager-1.036
⭐ Starred 27 / Imager::Color::Float
Security Advisories (3)
CVE-2026-102504 (2026-10-01)

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.

CVE-2026-102505 (2026-10-01)

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.

CVE-2026-112202 (2026-10-20)

Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.

NAME

Imager::Color::Float - Rough floating point sample color handling

SYNOPSIS

$color = Imager::Color->new($red, $green, $blue);
$color = Imager::Color->new($red, $green, $blue, $alpha);
$color = Imager::Color->new("#C0C0FF"); # html color specification

$color->set($red, $green, $blue);
$color->set($red, $green, $blue, $alpha);
$color->set("#C0C0FF"); # html color specification

($red, $green, $blue, $alpha) = $color->rgba();
@hsv = $color->hsv(); # not implemented but proposed
my $c8 = $color->as_8bit;

$color->info();

DESCRIPTION

This module handles creating color objects used by Imager. The idea is that in the future this module will be able to handle color space calculations as well.

A floating point Imager color consists of up to four components, each in the range 0.0 to 1.0. Unfortunately the meaning of the components can change depending on the type of image you're dealing with:

  • for 3 or 4 channel images the color components are red, green, blue, alpha.

  • for 1 or 2 channel images the color components are gray, alpha, with the other two components ignored.

An alpha value of zero is fully transparent, an alpha value of 1.0 is fully opaque.

METHODS

new

This creates a color object to pass to functions that need a color argument.

set

This changes an already defined color. Note that this does not affect any places where the color has been used previously.

rgba()

This returns the red, green, blue and alpha channels of the color the object contains.

info

Calling info merely dumps the relevant color to the log.

red
green
blue
alpha

Returns the respective component as a floating point value typically from 0 to 1.0.

as_8bit

Returns the color as the roughly equivalent 8-bit Imager::Color object. Samples below zero or above 1.0 are clipped.

as_css_rgb

Formats the color as a CSS rgb() style color. If the color is closely representable as byte style syntax, eg rgb(255, 128, 128), it will be returned in that form, otherwise the samples are formatted as percentages with up to 2 decimal places.

Setting colors

The new() and set() methods can accept the following parameters:

  • an Imager::Color::Float object

  • an Imager::Color object, the ranges of samples are translated from 0...255 to 0.0...1.0.

  • 3 values, treated as red, green, blue

  • 4 values, treated as red, green, blue, alpha

  • an 8 character hex color, optionally preceded by #.

  • a 6 character hex color, optionally preceded by #.

  • a CSS rgb() color, based on CSS Color 4. The none keyword is not supported and numbers must be simple decimals without exponents. eg.

    rgb(50% 50% 100%)
rgb(0, 0, 255)
rgb(0.5 0.5 1.0 / 0.8)
rgb(50%, 50%, 100%, 80%)

    This accepts some colors not accepted by the CSS rgb() specification, this may change.

AUTHOR

Arnar M. Hrafnkelsson, addi@umich.edu And a great deal of help from others - see the README for a complete list.

SEE ALSO

Imager(3), Imager::Color.

http://imager.perl.org/