From 46822d0eddc3324b2a056bc60ffa997027bebd66 Mon Sep 17 00:00:00 2001 From: Young_X Date: Fri, 23 Nov 2018 15:58:23 +0800 Subject: [PATCH] [JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987) Signed-off-by: Young_X --- src/bin/jpwl/convert.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/bin/jpwl/convert.c b/src/bin/jpwl/convert.c index 04ca64ca..4f636c17 100644 --- a/src/bin/jpwl/convert.c +++ b/src/bin/jpwl/convert.c @@ -445,7 +445,7 @@ int imagetotga(opj_image_t * image, const char *outfile) { int width, height, bpp, x, y; opj_bool write_alpha; - int i, adjustR, adjustG, adjustB; + int i, adjustR, adjustG = 0, adjustB = 0; unsigned int alpha_channel; float r, g, b, a; unsigned char value; @@ -486,8 +486,10 @@ int imagetotga(opj_image_t * image, const char *outfile) scale = 255.0f / (float)((1 << image->comps[0].prec) - 1); adjustR = (image->comps[0].sgnd ? 1 << (image->comps[0].prec - 1) : 0); - adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0); - adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0); + if (image->numcomps >= 3) { + adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0); + adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0); + } for (y = 0; y < height; y++) { unsigned int index = y * width;