walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Merge pull request #1211 from sebras/master 

Add check to validate SGcod/SPcoc/SPcod parameter values.
This commit is contained in:
Even Rouault 2020-05-20 21:10:55 +02:00 committed by GitHub
parent 1d358f25c8 f3ee448815
commit 19ef7f26c4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 28 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/lib/openjp2/j2k.c
View File

@ -2707,6 +2707,12 @@ static OPJ_BOOL opj_j2k_read_cod(opj_j2k_t *p_j2k,
opj_read_bytes(p_header_data, &l_tcp->mct, 1); /* SGcod (C) */
++p_header_data;
if (l_tcp->mct > 1) {
opj_event_msg(p_manager, EVT_ERROR,
"Invalid multiple component transformation\n");
return OPJ_FALSE;
}
p_header_size -= 5;
for (i = 0; i < l_image->numcomps; ++i) {
l_tcp->tccps[i].csty = l_tcp->csty & J2K_CCP_CSTY_PRT;
@ -10507,9 +10513,9 @@ static OPJ_BOOL opj_j2k_read_SPCod_SPCoc(opj_j2k_t *p_j2k,
return OPJ_FALSE;
}
opj_read_bytes(l_current_ptr, &l_tccp->numresolutions,
1); /* SPcox (D) */
++l_tccp->numresolutions; /* tccp->numresolutions = read() + 1 */
/* SPcod (D) / SPcoc (A) */
opj_read_bytes(l_current_ptr, &l_tccp->numresolutions, 1);
++l_tccp->numresolutions; /* tccp->numresolutions = read() + 1 */
if (l_tccp->numresolutions > OPJ_J2K_MAXRLVLS) {
opj_event_msg(p_manager, EVT_ERROR,
"Invalid value for numresolutions : %d, max value is set in openjpeg.h at %d\n",
@ -10530,11 +10536,13 @@ static OPJ_BOOL opj_j2k_read_SPCod_SPCoc(opj_j2k_t *p_j2k,
return OPJ_FALSE;
}
opj_read_bytes(l_current_ptr, &l_tccp->cblkw, 1); /* SPcoc (E) */
/* SPcod (E) / SPcoc (B) */
opj_read_bytes(l_current_ptr, &l_tccp->cblkw, 1);
++l_current_ptr;
l_tccp->cblkw += 2;
opj_read_bytes(l_current_ptr, &l_tccp->cblkh, 1); /* SPcoc (F) */
/* SPcod (F) / SPcoc (C) */
opj_read_bytes(l_current_ptr, &l_tccp->cblkh, 1);
++l_current_ptr;
l_tccp->cblkh += 2;
@ -10545,8 +10553,8 @@ static OPJ_BOOL opj_j2k_read_SPCod_SPCoc(opj_j2k_t *p_j2k,
return OPJ_FALSE;
}
opj_read_bytes(l_current_ptr, &l_tccp->cblksty, 1); /* SPcoc (G) */
/* SPcod (G) / SPcoc (D) */
opj_read_bytes(l_current_ptr, &l_tccp->cblksty, 1);
++l_current_ptr;
if (l_tccp->cblksty & 0xC0U) { /* 2 msb are reserved, assume we can't read */
opj_event_msg(p_manager, EVT_ERROR,
@ -10554,9 +10562,16 @@ static OPJ_BOOL opj_j2k_read_SPCod_SPCoc(opj_j2k_t *p_j2k,
return OPJ_FALSE;
}
opj_read_bytes(l_current_ptr, &l_tccp->qmfbid, 1); /* SPcoc (H) */
/* SPcod (H) / SPcoc (E) */
opj_read_bytes(l_current_ptr, &l_tccp->qmfbid, 1);
++l_current_ptr;
if (l_tccp->qmfbid > 1) {
opj_event_msg(p_manager, EVT_ERROR,
"Error reading SPCod SPCoc element, Invalid transformation found\n");
return OPJ_FALSE;
}
*p_header_size = *p_header_size - 5;
/* use custom precinct size ? */
@ -10566,8 +10581,9 @@ static OPJ_BOOL opj_j2k_read_SPCod_SPCoc(opj_j2k_t *p_j2k,
return OPJ_FALSE;
}
/* SPcod (I_i) / SPcoc (F_i) */
for (i = 0; i < l_tccp->numresolutions; ++i) {
opj_read_bytes(l_current_ptr, &l_tmp, 1); /* SPcoc (I_i) */
opj_read_bytes(l_current_ptr, &l_tmp, 1);
++l_current_ptr;
/* Precinct exponent 0 is only allowed for lowest resolution level (Table A.21) */
if ((i != 0) && (((l_tmp & 0xf) == 0) || ((l_tmp >> 4) == 0))) {

4
tests/nonregression/CMakeLists.txt
View File

@ -34,7 +34,6 @@ set(BLACKLIST_JPEG2000_TMP
edf_c2_1178956.jp2
edf_c2_1000290.jp2
#edf_c2_1000691.jp2 # ok
#edf_c2_20.jp2 #looks ok as per kdu_jp2info
edf_c2_1377017.jp2
edf_c2_1002767.jp2
edf_c2_10025.jp2
@ -61,6 +60,7 @@ set(BLACKLIST_JPEG2000
broken2.jp2
broken3.jp2
broken4.jp2
edf_c2_20.jp2 #may look ok as per kdu_jp2info, but inspection it reveals that the transformation value is out of range
gdal_fuzzer_assert_in_opj_j2k_read_SQcd_SQcc.patch.jp2
gdal_fuzzer_check_comp_dx_dy.jp2
gdal_fuzzer_check_number_of_tiles.jp2
@ -82,6 +82,8 @@ set(BLACKLIST_JPEG2000
issue475.jp2 #kdu_jp2info ok
issue413.jp2 #kdu_jp2info ok
issue823.jp2 #kdu_jp2info ok
issue826.jp2 #inspection reveales that the transformation value is out of range
oss-fuzz2785.jp2 #inspection reveales that the transformation value is out of range
)
file(GLOB_RECURSE OPJ_DATA_NR_LIST