walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

[JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987) 

Signed-off-by: Young_X <YangX92@hotmail.com>
This commit is contained in:
Young_X 2018-11-23 15:58:23 +08:00
parent 619e1b086e
commit 46822d0edd
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/bin/jpwl/convert.c
View File

@ -445,7 +445,7 @@ int imagetotga(opj_image_t * image, const char *outfile)
{ {
int width, height, bpp, x, y; int width, height, bpp, x, y;
opj_bool write_alpha; opj_bool write_alpha;
int i, adjustR, adjustG, adjustB; int i, adjustR, adjustG = 0, adjustB = 0;
unsigned int alpha_channel; unsigned int alpha_channel;
float r, g, b, a; float r, g, b, a;
unsigned char value; unsigned char value;
@ -486,8 +486,10 @@ int imagetotga(opj_image_t * image, const char *outfile)
scale = 255.0f / (float)((1 << image->comps[0].prec) - 1); scale = 255.0f / (float)((1 << image->comps[0].prec) - 1);
adjustR = (image->comps[0].sgnd ? 1 << (image->comps[0].prec - 1) : 0); adjustR = (image->comps[0].sgnd ? 1 << (image->comps[0].prec - 1) : 0);
adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0); if (image->numcomps >= 3) {
adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0); adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0);
adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0);
}
for (y = 0; y < height; y++) { for (y = 0; y < height; y++) {
unsigned int index = y * width; unsigned int index = y * width;