walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Merge pull request #1172 from hlef/master 

convertbmp: detect invalid file dimensions early (CVE-2018-6616)
This commit is contained in:
Even Rouault 2018-12-21 16:41:00 +01:00 committed by GitHub
parent e7640f58f1 8ee335227b
commit 51f097e6d5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/bin/jp2/convertbmp.c
View File

@ -534,14 +534,14 @@ static OPJ_BOOL bmp_read_raw_data(FILE* IN, OPJ_UINT8* pData, OPJ_UINT32 stride,
static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData, static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height) OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height)
{ {
OPJ_UINT32 x, y; OPJ_UINT32 x, y, written;
OPJ_UINT8 *pix; OPJ_UINT8 *pix;
const OPJ_UINT8 *beyond; const OPJ_UINT8 *beyond;
beyond = pData + stride * height; beyond = pData + stride * height;
pix = pData; pix = pData;
x = y = 0U; x = y = written = 0U;
while (y < height) { while (y < height) {
int c = getc(IN); int c = getc(IN);
if (c == EOF) { if (c == EOF) {
@ -561,6 +561,7 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
for (j = 0; (j < c) && (x < width) && for (j = 0; (j < c) && (x < width) &&
((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) { ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
*pix = c1; *pix = c1;
written++;
} }
} else { } else {
c = getc(IN); c = getc(IN);
@ -598,6 +599,7 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
} }
c1 = (OPJ_UINT8)c1_int; c1 = (OPJ_UINT8)c1_int;
*pix = c1; *pix = c1;
written++;
} }
if ((OPJ_UINT32)c & 1U) { /* skip padding byte */ if ((OPJ_UINT32)c & 1U) { /* skip padding byte */
c = getc(IN); c = getc(IN);
@ -608,6 +610,12 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
} }
} }
}/* while() */ }/* while() */
if (written != width * height) {
fprintf(stderr, "warning, image's actual size does not match advertized one\n");
return OPJ_FALSE;
}
return OPJ_TRUE; return OPJ_TRUE;
} }