From 1acfa211ae85f2716064f041868f0fc5d6427590 Mon Sep 17 00:00:00 2001 From: Antonin Descampe Date: Tue, 30 Sep 2014 09:48:26 +0000 Subject: [PATCH] [trunk] fixes heap-buffer-overflow in parse_cmdline_encoder Fixes issue 403 Thanks Matthieu --- src/bin/jp2/opj_compress.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c index db21c5a4..55828b1f 100644 --- a/src/bin/jp2/opj_compress.c +++ b/src/bin/jp2/opj_compress.c @@ -1501,12 +1501,10 @@ static int parse_cmdline_encoder(int argc, char **argv, opj_cparameters_t *param } /* If subsampled image is provided, automatically disable MCT */ - if ( ((parameters->decod_format == RAW_DFMT) - || (parameters->decod_format == RAWL_DFMT)) - && ((raw_cp->rawComps[1].dx > 1) - || (raw_cp->rawComps[1].dy > 1) - || (raw_cp->rawComps[2].dx > 1) - || (raw_cp->rawComps[2].dy > 1))) { + if ( ((parameters->decod_format == RAW_DFMT) || (parameters->decod_format == RAWL_DFMT)) + && ( ((raw_cp->rawComp > 1 ) && ((raw_cp->rawComps[1].dx > 1) || (raw_cp->rawComps[1].dy > 1))) + || ((raw_cp->rawComp > 2 ) && ((raw_cp->rawComps[2].dx > 1) || (raw_cp->rawComps[2].dy > 1))) + )) { parameters->tcp_mct = 0; }