walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

[1.5] jp2_read_boxhdr() can trigger random pointer memory access 

Fixes issue 155
This commit is contained in:
Mathieu Malaterre 2012-10-01 15:57:01 +00:00
parent 7720188fa7
commit 6280b5ad8d
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libopenjpeg/jp2.c
View File

@ -173,6 +173,10 @@ static opj_bool jp2_read_boxhdr(opj_common_ptr cinfo, opj_cio_t *cio, opj_jp2_bo
else if (box->length == 0) { else if (box->length == 0) {
box->length = cio_numbytesleft(cio) + 8; box->length = cio_numbytesleft(cio) + 8;
} }
if (box->length < 0) {
opj_event_msg(cinfo, EVT_ERROR, "Integer overflow in box->length\n");
return OPJ_FALSE; // TODO: actually check jp2_read_boxhdr's return value
}
return OPJ_TRUE; return OPJ_TRUE;
} }
@ -654,6 +658,7 @@ opj_bool jp2_read_jp2h(opj_jp2_t *jp2, opj_cio_t *cio, opj_jp2_color_t *color)
opj_event_msg(cinfo, EVT_ERROR, "Expected JP2H Marker\n"); opj_event_msg(cinfo, EVT_ERROR, "Expected JP2H Marker\n");
return OPJ_FALSE; return OPJ_FALSE;
} }
if (box.length <= 8) return OPJ_FALSE;
cio_skip(cio, box.length - 8); cio_skip(cio, box.length - 8);
if(cio->bp >= cio->end) return OPJ_FALSE; if(cio->bp >= cio->end) return OPJ_FALSE;
@ -679,6 +684,7 @@ opj_bool jp2_read_jp2h(opj_jp2_t *jp2, opj_cio_t *cio, opj_jp2_color_t *color)
{ {
if( !jp2_read_colr(jp2, cio, &box, color)) if( !jp2_read_colr(jp2, cio, &box, color))
{ {
if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8); cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8); cio_skip(cio, box.length - 8);
} }
@ -689,6 +695,7 @@ opj_bool jp2_read_jp2h(opj_jp2_t *jp2, opj_cio_t *cio, opj_jp2_color_t *color)
{ {
if( !jp2_read_cdef(jp2, cio, &box, color)) if( !jp2_read_cdef(jp2, cio, &box, color))
{ {
if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8); cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8); cio_skip(cio, box.length - 8);
} }
@ -699,6 +706,7 @@ opj_bool jp2_read_jp2h(opj_jp2_t *jp2, opj_cio_t *cio, opj_jp2_color_t *color)
{ {
if( !jp2_read_pclr(jp2, cio, &box, color)) if( !jp2_read_pclr(jp2, cio, &box, color))
{ {
if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8); cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8); cio_skip(cio, box.length - 8);
} }
@ -709,12 +717,14 @@ opj_bool jp2_read_jp2h(opj_jp2_t *jp2, opj_cio_t *cio, opj_jp2_color_t *color)
{ {
if( !jp2_read_cmap(jp2, cio, &box, color)) if( !jp2_read_cmap(jp2, cio, &box, color))
{ {
if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8); cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8); cio_skip(cio, box.length - 8);
} }
if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE; if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE;
continue; continue;
} }
if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8); cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8); cio_skip(cio, box.length - 8);
if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE; if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE;
@ -910,12 +920,14 @@ static opj_bool jp2_read_jp2c(opj_jp2_t *jp2, opj_cio_t *cio, unsigned int *j2k_
} }
do { do {
if(JP2_JP2C != box.type) { if(JP2_JP2C != box.type) {
if (box.length <= 8) return OPJ_FALSE;
cio_skip(cio, box.length - 8); cio_skip(cio, box.length - 8);
if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE; if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE;
} }
} while(JP2_JP2C != box.type); } while(JP2_JP2C != box.type);
*j2k_codestream_offset = cio_tell(cio); *j2k_codestream_offset = cio_tell(cio);
if (box.length <= 8) return OPJ_FALSE;
*j2k_codestream_length = box.length - 8; *j2k_codestream_length = box.length - 8;
return OPJ_TRUE; return OPJ_TRUE;