walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Merge pull request #1185 from Young-X/fix 

Fix several potential vulnerabilities
This commit is contained in:
Even Rouault 2019-04-26 19:52:52 +02:00 committed by GitHub
parent 4f447c6e18 3aef207f90
commit 9b7620ee7a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 34 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
src/bin/jp2/convertbmp.c
View File

@ -622,31 +622,38 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData,
static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData, static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height) OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height)
{ {
OPJ_UINT32 x, y; OPJ_UINT32 x, y, written;
OPJ_UINT8 *pix; OPJ_UINT8 *pix;
const OPJ_UINT8 *beyond; const OPJ_UINT8 *beyond;
beyond = pData + stride * height; beyond = pData + stride * height;
pix = pData; pix = pData;
x = y = 0U; x = y = written = 0U;
while (y < height) { while (y < height) {
int c = getc(IN); int c = getc(IN);
if (c == EOF) { if (c == EOF) {
break; return OPJ_FALSE;
} }
if (c) { /* encoded mode */ if (c) { /* encoded mode */
int j; int j, c1_int;
OPJ_UINT8 c1 = (OPJ_UINT8)getc(IN); OPJ_UINT8 c1;
c1_int = getc(IN);
if (c1_int == EOF) {
return OPJ_FALSE;
}
c1 = (OPJ_UINT8)c1_int;
for (j = 0; (j < c) && (x < width) && for (j = 0; (j < c) && (x < width) &&
((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) { ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
*pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU)); *pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
written++;
} }
} else { /* absolute mode */ } else { /* absolute mode */
c = getc(IN); c = getc(IN);
if (c == EOF) { if (c == EOF) {
break; return OPJ_FALSE;
} }
if (c == 0x00) { /* EOL */ if (c == 0x00) { /* EOL */
@ -657,8 +664,14 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
break; break;
} else if (c == 0x02) { /* MOVE by dxdy */ } else if (c == 0x02) { /* MOVE by dxdy */
c = getc(IN); c = getc(IN);
if (c == EOF) {
return OPJ_FALSE;
}
x += (OPJ_UINT32)c; x += (OPJ_UINT32)c;
c = getc(IN); c = getc(IN);
if (c == EOF) {
return OPJ_FALSE;
}
y += (OPJ_UINT32)c; y += (OPJ_UINT32)c;
pix = pData + y * stride + x; pix = pData + y * stride + x;
} else { /* 03 .. 255 : absolute mode */ } else { /* 03 .. 255 : absolute mode */
@ -668,16 +681,29 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
for (j = 0; (j < c) && (x < width) && for (j = 0; (j < c) && (x < width) &&
((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) { ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
if ((j & 1) == 0) { if ((j & 1) == 0) {
c1 = (OPJ_UINT8)getc(IN); int c1_int;
c1_int = getc(IN);
if (c1_int == EOF) {
return OPJ_FALSE;
}
c1 = (OPJ_UINT8)c1_int;
} }
*pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU)); *pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
written++;
} }
if (((c & 3) == 1) || ((c & 3) == 2)) { /* skip padding byte */ if (((c & 3) == 1) || ((c & 3) == 2)) { /* skip padding byte */
getc(IN); c = getc(IN);
if (c == EOF) {
return OPJ_FALSE;
}
} }
} }
} }
} /* while(y < height) */ } /* while(y < height) */
if (written != width * height) {
fprintf(stderr, "warning, image's actual size does not match advertized one\n");
return OPJ_FALSE;
}
return OPJ_TRUE; return OPJ_TRUE;
} }