walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

Fix heap-buffer-overflow in color_esycc_to_rgb (#748) 

When all components do not have the same dx/dy, components buffer are
read beyond their end.
Do not convert in this case.

Update uclouvain/openjpeg#725
This commit is contained in:
Matthieu Darbois 2016-04-29 23:51:14 +02:00
parent 319fc971fe
commit ad593c9e06
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/bin/common/color.c
View File

@ -890,7 +890,14 @@ void color_esycc_to_rgb(opj_image_t *image)
int flip_value = (1 << (image->comps[0].prec-1)); int flip_value = (1 << (image->comps[0].prec-1));
int max_value = (1 << image->comps[0].prec) - 1; int max_value = (1 << image->comps[0].prec) - 1;
if(image->numcomps < 3) return; if (
(image->numcomps < 3)
|| (image->comps[0].dx != image->comps[1].dx) || (image->comps[0].dx != image->comps[2].dx)
|| (image->comps[0].dy != image->comps[1].dy) || (image->comps[0].dy != image->comps[2].dy)
) {
fprintf(stderr,"%s:%d:color_esycc_to_rgb\n\tCAN NOT CONVERT\n", __FILE__,__LINE__);
return;
}
w = image->comps[0].w; w = image->comps[0].w;
h = image->comps[0].h; h = image->comps[0].h;