walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987)

This commit is contained in:
Even Rouault 2017-08-16 13:11:36 +02:00
parent 9624b2fa47
commit ab4de904e7
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/bin/jp2/convert.c
View File

@ -941,7 +941,7 @@ int imagetotga(opj_image_t * image, const char *outfile)
int width, height, bpp, x, y; int width, height, bpp, x, y;
OPJ_BOOL write_alpha; OPJ_BOOL write_alpha;
unsigned int i; unsigned int i;
int adjustR, adjustG, adjustB, fails; int adjustR, adjustG = 0, adjustB = 0, fails;
unsigned int alpha_channel; unsigned int alpha_channel;
float r, g, b, a; float r, g, b, a;
unsigned char value; unsigned char value;
@ -986,8 +986,10 @@ int imagetotga(opj_image_t * image, const char *outfile)
scale = 255.0f / (float)((1 << image->comps[0].prec) - 1); scale = 255.0f / (float)((1 << image->comps[0].prec) - 1);
adjustR = (image->comps[0].sgnd ? 1 << (image->comps[0].prec - 1) : 0); adjustR = (image->comps[0].sgnd ? 1 << (image->comps[0].prec - 1) : 0);
adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0); if (image->numcomps >= 3) {
adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0); adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0);
adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0);
}
for (y = 0; y < height; y++) { for (y = 0; y < height; y++) {
unsigned int index = (unsigned int)(y * width); unsigned int index = (unsigned int)(y * width);