walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

pi.c: avoid out of bounds access with POC (fixes #1302)

This commit is contained in:
Even Rouault 2020-12-04 20:45:25 +01:00
parent 43dd9ee178
commit 8f5aff1dff
No known key found for this signature in database
GPG Key ID: 33EBBFC47B3DD87D
1 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/lib/openjp2/pi.c
View File

@ -240,6 +240,13 @@ static OPJ_BOOL opj_pi_next_lrcp(opj_pi_iterator_t * pi)
opj_pi_resolution_t *res = NULL; opj_pi_resolution_t *res = NULL;
OPJ_UINT32 index = 0; OPJ_UINT32 index = 0;
if (pi->poc.compno0 >= pi->numcomps ||
pi->poc.compno1 >= pi->numcomps + 1) {
opj_event_msg(pi->manager, EVT_ERROR,
"opj_pi_next_lrcp(): invalid compno0/compno1\n");
return OPJ_FALSE;
}
if (!pi->first) { if (!pi->first) {
comp = &pi->comps[pi->compno]; comp = &pi->comps[pi->compno];
res = &comp->resolutions[pi->resno]; res = &comp->resolutions[pi->resno];
@ -293,6 +300,13 @@ static OPJ_BOOL opj_pi_next_rlcp(opj_pi_iterator_t * pi)
opj_pi_resolution_t *res = NULL; opj_pi_resolution_t *res = NULL;
OPJ_UINT32 index = 0; OPJ_UINT32 index = 0;
if (pi->poc.compno0 >= pi->numcomps ||
pi->poc.compno1 >= pi->numcomps + 1) {
opj_event_msg(pi->manager, EVT_ERROR,
"opj_pi_next_rlcp(): invalid compno0/compno1\n");
return OPJ_FALSE;
}
if (!pi->first) { if (!pi->first) {
comp = &pi->comps[pi->compno]; comp = &pi->comps[pi->compno];
res = &comp->resolutions[pi->resno]; res = &comp->resolutions[pi->resno];
@ -339,6 +353,13 @@ static OPJ_BOOL opj_pi_next_rpcl(opj_pi_iterator_t * pi)
opj_pi_resolution_t *res = NULL; opj_pi_resolution_t *res = NULL;
OPJ_UINT32 index = 0; OPJ_UINT32 index = 0;
if (pi->poc.compno0 >= pi->numcomps ||
pi->poc.compno1 >= pi->numcomps + 1) {
opj_event_msg(pi->manager, EVT_ERROR,
"opj_pi_next_rpcl(): invalid compno0/compno1\n");
return OPJ_FALSE;
}
if (!pi->first) { if (!pi->first) {
goto LABEL_SKIP; goto LABEL_SKIP;
} else { } else {
@ -474,7 +495,7 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_iterator_t * pi)
if (pi->poc.compno0 >= pi->numcomps || if (pi->poc.compno0 >= pi->numcomps ||
pi->poc.compno1 >= pi->numcomps + 1) { pi->poc.compno1 >= pi->numcomps + 1) {
opj_event_msg(pi->manager, EVT_ERROR, opj_event_msg(pi->manager, EVT_ERROR,
"opj_pi_next_pcrl(): invalid compno0/compno1"); "opj_pi_next_pcrl(): invalid compno0/compno1\n");
return OPJ_FALSE; return OPJ_FALSE;
} }
@ -612,7 +633,7 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_iterator_t * pi)
if (pi->poc.compno0 >= pi->numcomps || if (pi->poc.compno0 >= pi->numcomps ||
pi->poc.compno1 >= pi->numcomps + 1) { pi->poc.compno1 >= pi->numcomps + 1) {
opj_event_msg(pi->manager, EVT_ERROR, opj_event_msg(pi->manager, EVT_ERROR,
"opj_pi_next_cprl(): invalid compno0/compno1"); "opj_pi_next_cprl(): invalid compno0/compno1\n");
return OPJ_FALSE; return OPJ_FALSE;
} }