walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Merge pull request #1160 from hlef/master 

jp3d/jpwl convert: fix write stack buffer overflow
This commit is contained in:
Even Rouault 2018-11-16 09:42:19 +01:00 committed by GitHub
parent c196b23b90 cab352e249
commit 92023cd6c3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/bin/jp2/convert.c
View File

@ -2233,6 +2233,11 @@ int imagetopnm(opj_image_t * image, const char *outfile, int force_split)
opj_version(), wr, hr, max); opj_version(), wr, hr, max);
red = image->comps[compno].data; red = image->comps[compno].data;
if (!red) {
fclose(fdest);
continue;
}
adjustR = adjustR =
(image->comps[compno].sgnd ? 1 << (image->comps[compno].prec - 1) : 0); (image->comps[compno].sgnd ? 1 << (image->comps[compno].prec - 1) : 0);

4
src/bin/jp3d/convert.c
View File

@ -297,8 +297,8 @@ opj_volume_t* pgxtovolume(char *relpath, opj_cparameters_t *parameters)
fprintf(stdout, "[INFO] Loading %s \n", pgxfiles[pos]); fprintf(stdout, "[INFO] Loading %s \n", pgxfiles[pos]);
fseek(f, 0, SEEK_SET); fseek(f, 0, SEEK_SET);
fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1, &endian2, fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1,
signtmp, &prec, temp, &w, temp, &h); &endian2, signtmp, &prec, temp, &w, temp, &h);
i = 0; i = 0;
sign = '+'; sign = '+';

2
src/bin/jpwl/convert.c
View File

@ -1349,7 +1349,7 @@ opj_image_t* pgxtoimage(const char *filename, opj_cparameters_t *parameters)
} }
fseek(f, 0, SEEK_SET); fseek(f, 0, SEEK_SET);
if (fscanf(f, "PG%[ \t]%c%c%[ \t+-]%d%[ \t]%d%[ \t]%d", temp, &endian1, if (fscanf(f, "PG%31[ \t]%c%c%31[ \t+-]%d%31[ \t]%d%31[ \t]%d", temp, &endian1,
&endian2, signtmp, &prec, temp, &w, temp, &h) != 9) { &endian2, signtmp, &prec, temp, &w, temp, &h) != 9) {
fprintf(stderr, fprintf(stderr,
"ERROR: Failed to read the right number of element from the fscanf() function!\n"); "ERROR: Failed to read the right number of element from the fscanf() function!\n");