diff --git a/src/lib/openjp2/tcd.c b/src/lib/openjp2/tcd.c index cba1e245..4388819a 100644 --- a/src/lib/openjp2/tcd.c +++ b/src/lib/openjp2/tcd.c @@ -1578,7 +1578,13 @@ OPJ_BOOL opj_tcd_mct_decode ( opj_tcd_t *p_tcd ) l_samples = (l_tile_comp->x1 - l_tile_comp->x0) * (l_tile_comp->y1 - l_tile_comp->y0); if (l_tile->numcomps >= 3 ){ - if (l_tcp->mct == 2) { + /* testcase 1336.pdf.asan.47.376 */ + if ((l_tile->comps[0].x1 - l_tile->comps[0].x0) * (l_tile->comps[0].y1 - l_tile->comps[0].y0) < (OPJ_INT32)l_samples || + (l_tile->comps[1].x1 - l_tile->comps[1].x0) * (l_tile->comps[1].y1 - l_tile->comps[1].y0) < (OPJ_INT32)l_samples || + (l_tile->comps[2].x1 - l_tile->comps[2].x0) * (l_tile->comps[2].y1 - l_tile->comps[2].y0) < (OPJ_INT32)l_samples) { + fprintf(stderr, "Tiles don't all have the same dimension. Skip the MCT step.\n"); + } + else if (l_tcp->mct == 2) { OPJ_BYTE ** l_data; if (! l_tcp->m_mct_decoding_matrix) { @@ -1659,6 +1665,8 @@ OPJ_BOOL opj_tcd_dc_level_shift_decode ( opj_tcd_t *p_tcd ) l_height = (l_res->y1 - l_res->y0); l_stride = (l_tile_comp->x1 - l_tile_comp->x0) - l_width; + assert(l_height == 0 || l_width + l_stride <= l_tile_comp->data_size / l_height); /*MUPDF*/ + if (l_img_comp->sgnd) { l_min = -(1 << (l_img_comp->prec - 1)); l_max = (1 << (l_img_comp->prec - 1)) - 1;