From 6e0162a8a67932e59489b6f6a3bec01d64d2db8b Mon Sep 17 00:00:00 2001 From: Mathieu Malaterre Date: Tue, 18 Mar 2014 14:19:21 +0000 Subject: [PATCH] [1.5] Check the number of tiles --- libopenjpeg/j2k.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libopenjpeg/j2k.c b/libopenjpeg/j2k.c index d51ab16c..c3635964 100644 --- a/libopenjpeg/j2k.c +++ b/libopenjpeg/j2k.c @@ -549,6 +549,15 @@ static void j2k_read_siz(opj_j2k_t *j2k) { cp->tw = int_ceildiv(image->x1 - cp->tx0, cp->tdx); cp->th = int_ceildiv(image->y1 - cp->ty0, cp->tdy); + /* gdal_fuzzer_check_number_of_tiles.jp2 */ + if (cp->tw == 0 || cp->th == 0 || cp->tw > 65535 / cp->th) { + opj_event_msg(j2k->cinfo, EVT_ERROR, + "Invalid number of tiles : %u x %u (maximum fixed by jpeg2000 norm is 65535 tiles)\n", + cp->tw, cp->th); + return; + } + + #ifdef USE_JPWL if (j2k->cp->correct) { /* if JPWL is on, we check whether TX errors have damaged