walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

opj_t2_encode_packet(): fix potential write heap buffer overflow (#992)

This commit is contained in:
Even Rouault 2017-08-16 17:20:29 +02:00
parent dcac91b8c7
commit c535531f03
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/lib/openjp2/j2k.c
View File

@ -4215,7 +4215,6 @@ static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,
assert(p_stream != 00); assert(p_stream != 00);
OPJ_UNUSED(p_stream); OPJ_UNUSED(p_stream);
OPJ_UNUSED(p_manager);
if (p_total_data_size < 12) { if (p_total_data_size < 12) {
opj_event_msg(p_manager, EVT_ERROR, opj_event_msg(p_manager, EVT_ERROR,
@ -4617,6 +4616,12 @@ static OPJ_BOOL opj_j2k_write_sod(opj_j2k_t *p_j2k,
OPJ_UNUSED(p_stream); OPJ_UNUSED(p_stream);
if (p_total_data_size < 4) {
opj_event_msg(p_manager, EVT_ERROR,
"Not enough bytes in output buffer to write SOD marker\n");
return OPJ_FALSE;
}
opj_write_bytes(p_data, J2K_MS_SOD, opj_write_bytes(p_data, J2K_MS_SOD,
2); /* SOD */ 2); /* SOD */
p_data += 2; p_data += 2;

18
src/lib/openjp2/t2.c
View File

@ -629,6 +629,15 @@ static OPJ_BOOL opj_t2_encode_packet(OPJ_UINT32 tileno,
/* <SOP 0xff91> */ /* <SOP 0xff91> */
if (tcp->csty & J2K_CP_CSTY_SOP) { if (tcp->csty & J2K_CP_CSTY_SOP) {
if (length < 6) {
if (p_t2_mode == FINAL_PASS) {
opj_event_msg(p_manager, EVT_ERROR,
"opj_t2_encode_packet(): only %u bytes remaining in "
"output buffer. %u needed.\n",
length, 6);
}
return OPJ_FALSE;
}
c[0] = 255; c[0] = 255;
c[1] = 145; c[1] = 145;
c[2] = 0; c[2] = 0;
@ -817,6 +826,15 @@ static OPJ_BOOL opj_t2_encode_packet(OPJ_UINT32 tileno,
/* <EPH 0xff92> */ /* <EPH 0xff92> */
if (tcp->csty & J2K_CP_CSTY_EPH) { if (tcp->csty & J2K_CP_CSTY_EPH) {
if (length < 2) {
if (p_t2_mode == FINAL_PASS) {
opj_event_msg(p_manager, EVT_ERROR,
"opj_t2_encode_packet(): only %u bytes remaining in "
"output buffer. %u needed.\n",
length, 2);
}
return OPJ_FALSE;
}
c[0] = 255; c[0] = 255;
c[1] = 146; c[1] = 146;
c += 2; c += 2;