From daed8cc9195555e101ab708a501af2dfe6d5e001 Mon Sep 17 00:00:00 2001 From: Matthieu Darbois Date: Tue, 19 May 2015 20:13:37 +0000 Subject: [PATCH 1/7] [trunk] Add check for at most 1 COD marker per tile. 1 COD marker for MH (fixes issue 476) --- src/lib/openjp2/j2k.c | 10 +++++++++- src/lib/openjp2/j2k.h | 2 ++ tests/nonregression/CMakeLists.txt | 1 + tests/nonregression/test_suite.ctest.in | 2 ++ 4 files changed, 14 insertions(+), 1 deletion(-) diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c index f944ad1a..0be00aa6 100644 --- a/src/lib/openjp2/j2k.c +++ b/src/lib/openjp2/j2k.c @@ -2431,7 +2431,14 @@ static OPJ_BOOL opj_j2k_read_cod ( opj_j2k_t *p_j2k, l_tcp = (p_j2k->m_specific_param.m_decoder.m_state == J2K_STATE_TPH) ? &l_cp->tcps[p_j2k->m_current_tile_number] : p_j2k->m_specific_param.m_decoder.m_default_tcp; - + + /* Only one COD per tile */ + if (l_tcp->cod) { + opj_event_msg(p_manager, EVT_ERROR, "COD marker already read. No more than one COD marker per tile.\n"); + return OPJ_FALSE; + } + l_tcp->cod = 1; + /* Make sure room is sufficient */ if (p_header_size < 5) { opj_event_msg(p_manager, EVT_ERROR, "Error reading COD marker\n"); @@ -7350,6 +7357,7 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2 /*Copy default coding parameters into the current tile coding parameters*/ memcpy(l_tcp, l_default_tcp, sizeof(opj_tcp_t)); /* Initialize some values of the current tile coding parameters*/ + l_tcp->cod = 0; l_tcp->ppt = 0; l_tcp->ppt_data = 00; /* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/ diff --git a/src/lib/openjp2/j2k.h b/src/lib/openjp2/j2k.h index 909e3511..10e22aa6 100644 --- a/src/lib/openjp2/j2k.h +++ b/src/lib/openjp2/j2k.h @@ -293,6 +293,8 @@ typedef struct opj_tcp /***** FLAGS *******/ + /** If cod == 1 --> there was a COD marker for the present tile */ + OPJ_UINT32 cod : 1; /** If ppt == 1 --> there was a PPT marker for the present tile */ OPJ_UINT32 ppt : 1; /** indicates if a POC marker has been used O:NO, 1:YES */ diff --git a/tests/nonregression/CMakeLists.txt b/tests/nonregression/CMakeLists.txt index cd068dea..f39d7e46 100644 --- a/tests/nonregression/CMakeLists.txt +++ b/tests/nonregression/CMakeLists.txt @@ -72,6 +72,7 @@ set(BLACKLIST_JPEG2000 issue420.jp2 #kdu_jp2info ok 27ac957758a35d00d6765a0c86350d9c.SIGFPE.d25.537.jpc #kdu_jp2info crash 3672da2f1f67bbecad27d7181b4e9d7c.SIGFPE.d25.805.jpc #kdu_jp2info crash + issue476.jp2 #kdu_jp2info ok ) file(GLOB_RECURSE OPJ_DATA_NR_LIST diff --git a/tests/nonregression/test_suite.ctest.in b/tests/nonregression/test_suite.ctest.in index 0cd5387f..e248c41a 100644 --- a/tests/nonregression/test_suite.ctest.in +++ b/tests/nonregression/test_suite.ctest.in @@ -260,6 +260,8 @@ opj_decompress -i @INPUT_NR_PATH@/issue411-ycc420.jp2 -o @TEMP_PATH@/issue411-yc !opj_decompress -i @INPUT_NR_PATH@/issue427-illegal-tile-offset.jp2 -o @TEMP_PATH@/issue427-illegal-tile-offset.jp2.pgx # issue 458 component precision upscaling opj_decompress -i @INPUT_NR_PATH@/issue458.jp2 -o @TEMP_PATH@/issue458.jp2.pgx +# issue 476 Multiple COD in MH +!opj_decompress -i @INPUT_NR_PATH@/issue476.jp2 -o @TEMP_PATH@/issue476.jp2.pgx # decode with specific area From 757f9394bf0811ff1355e31d4b7d8565770d0a48 Mon Sep 17 00:00:00 2001 From: Matthieu Darbois Date: Tue, 19 May 2015 21:24:44 +0000 Subject: [PATCH 2/7] [trunk] Add check for number of layers & cblkw/cblkh values (fixes issue 475) --- src/lib/openjp2/j2k.c | 11 +++++++++++ tests/nonregression/CMakeLists.txt | 2 ++ tests/nonregression/test_suite.ctest.in | 2 ++ 3 files changed, 15 insertions(+) diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c index 0be00aa6..8c62a39b 100644 --- a/src/lib/openjp2/j2k.c +++ b/src/lib/openjp2/j2k.c @@ -2462,6 +2462,11 @@ static OPJ_BOOL opj_j2k_read_cod ( opj_j2k_t *p_j2k, } opj_read_bytes(p_header_data,&l_tcp->numlayers,2); /* SGcod (B) */ p_header_data+=2; + + if ((l_tcp->numlayers < 1U) || (l_tcp->numlayers > 65535U)) { + opj_event_msg(p_manager, EVT_ERROR, "Invalid number of layers in COD marker : %d not in range [1-65535]\n", l_tcp->numlayers); + return OPJ_FALSE; + } /* If user didn't set a number layer to decode take the max specify in the codestream. */ if (l_cp->m_specific_param.m_dec.m_layer) { @@ -8631,6 +8636,12 @@ OPJ_BOOL opj_j2k_read_SPCod_SPCoc( opj_j2k_t *p_j2k, ++l_current_ptr; l_tccp->cblkh += 2; + if ((l_tccp->cblkw > 10) || (l_tccp->cblkh > 10) || ((l_tccp->cblkw + l_tccp->cblkh) > 12)) { + opj_event_msg(p_manager, EVT_ERROR, "Error reading SPCod SPCoc element, Invalid cblkw/cblkh combination\n"); + return OPJ_FALSE; + } + + opj_read_bytes(l_current_ptr,&l_tccp->cblksty ,1); /* SPcoc (G) */ ++l_current_ptr; diff --git a/tests/nonregression/CMakeLists.txt b/tests/nonregression/CMakeLists.txt index f39d7e46..f5b7e901 100644 --- a/tests/nonregression/CMakeLists.txt +++ b/tests/nonregression/CMakeLists.txt @@ -73,6 +73,8 @@ set(BLACKLIST_JPEG2000 27ac957758a35d00d6765a0c86350d9c.SIGFPE.d25.537.jpc #kdu_jp2info crash 3672da2f1f67bbecad27d7181b4e9d7c.SIGFPE.d25.805.jpc #kdu_jp2info crash issue476.jp2 #kdu_jp2info ok + issue475.jp2 #kdu_jp2info ok + issue413.jp2 #kdu_jp2info ok ) file(GLOB_RECURSE OPJ_DATA_NR_LIST diff --git a/tests/nonregression/test_suite.ctest.in b/tests/nonregression/test_suite.ctest.in index e248c41a..a8943424 100644 --- a/tests/nonregression/test_suite.ctest.in +++ b/tests/nonregression/test_suite.ctest.in @@ -262,6 +262,8 @@ opj_decompress -i @INPUT_NR_PATH@/issue411-ycc420.jp2 -o @TEMP_PATH@/issue411-yc opj_decompress -i @INPUT_NR_PATH@/issue458.jp2 -o @TEMP_PATH@/issue458.jp2.pgx # issue 476 Multiple COD in MH !opj_decompress -i @INPUT_NR_PATH@/issue476.jp2 -o @TEMP_PATH@/issue476.jp2.pgx +# issue 475 Invalid number of layers +!opj_decompress -i @INPUT_NR_PATH@/issue475.jp2 -o @TEMP_PATH@/issue475.jp2.pgx # decode with specific area From 0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0 Mon Sep 17 00:00:00 2001 From: Matthieu Darbois Date: Tue, 19 May 2015 21:57:27 +0000 Subject: [PATCH 3/7] [trunk] Correct potential double free on malloc failure in opj_j2k_copy_default_tcp_and_create_tcp (fixes issue 492) --- src/lib/openjp2/j2k.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c index 8c62a39b..cbdd3688 100644 --- a/src/lib/openjp2/j2k.c +++ b/src/lib/openjp2/j2k.c @@ -7365,6 +7365,12 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2 l_tcp->cod = 0; l_tcp->ppt = 0; l_tcp->ppt_data = 00; + /* Remove memory not owned by this tile in case of early error return. */ + l_tcp->m_mct_decoding_matrix = 00; + l_tcp->m_nb_max_mct_records = 0; + l_tcp->m_mct_records = 00; + l_tcp->m_nb_max_mcc_records = 0; + l_tcp->m_mcc_records = 00; /* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/ l_tcp->tccps = l_current_tccp; @@ -7402,6 +7408,8 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2 ++l_src_mct_rec; ++l_dest_mct_rec; + /* Update with each pass to free exactly what has been allocated on early return. */ + l_tcp->m_nb_max_mct_records += 1; } /* Get the mcc_record of the dflt_tile_cp and copy them into the current tile cp*/ @@ -7411,6 +7419,7 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2 return OPJ_FALSE; } memcpy(l_tcp->m_mcc_records,l_default_tcp->m_mcc_records,l_mcc_records_size); + l_tcp->m_nb_max_mcc_records = l_default_tcp->m_nb_max_mcc_records; /* Copy the mcc record data from dflt_tile_cp to the current tile*/ l_src_mcc_rec = l_default_tcp->m_mcc_records; From e3291c4e1f26c1f756e360110423ab0a63be4204 Mon Sep 17 00:00:00 2001 From: Matthieu Darbois Date: Wed, 27 May 2015 23:05:16 +0000 Subject: [PATCH 4/7] [trunk] Fix overflow in opj_image_comp_header_update (fixes issue 495) --- src/lib/openjp2/image.c | 30 +++++++++++++------------ src/lib/openjp2/opj_intmath.h | 9 ++++++++ tests/nonregression/md5refs.txt | 3 +++ tests/nonregression/test_suite.ctest.in | 2 ++ 4 files changed, 30 insertions(+), 14 deletions(-) diff --git a/src/lib/openjp2/image.c b/src/lib/openjp2/image.c index 8e68668e..3646e998 100644 --- a/src/lib/openjp2/image.c +++ b/src/lib/openjp2/image.c @@ -107,27 +107,29 @@ void OPJ_CALLCONV opj_image_destroy(opj_image_t *image) { void opj_image_comp_header_update(opj_image_t * p_image_header, const struct opj_cp * p_cp) { OPJ_UINT32 i, l_width, l_height; - OPJ_INT32 l_x0, l_y0, l_x1, l_y1; - OPJ_INT32 l_comp_x0, l_comp_y0, l_comp_x1, l_comp_y1; + OPJ_UINT32 l_x0, l_y0, l_x1, l_y1; + OPJ_UINT32 l_comp_x0, l_comp_y0, l_comp_x1, l_comp_y1; opj_image_comp_t* l_img_comp = NULL; - l_x0 = opj_int_max((OPJ_INT32)p_cp->tx0 , (OPJ_INT32)p_image_header->x0); - l_y0 = opj_int_max((OPJ_INT32)p_cp->ty0 , (OPJ_INT32)p_image_header->y0); - l_x1 = opj_int_min((OPJ_INT32)(p_cp->tx0 + p_cp->tw * p_cp->tdx), (OPJ_INT32)p_image_header->x1); - l_y1 = opj_int_min((OPJ_INT32)(p_cp->ty0 + p_cp->th * p_cp->tdy), (OPJ_INT32)p_image_header->y1); + l_x0 = opj_uint_max(p_cp->tx0 , p_image_header->x0); + l_y0 = opj_uint_max(p_cp->ty0 , p_image_header->y0); + l_x1 = p_cp->tx0 + (p_cp->tw - 1U) * p_cp->tdx; /* validity of p_cp members used here checked in opj_j2k_read_siz. Can't overflow. */ + l_y1 = p_cp->ty0 + (p_cp->th - 1U) * p_cp->tdy; /* can't overflow */ + l_x1 = opj_uint_min(opj_uint_adds(l_x1, p_cp->tdx), p_image_header->x1); /* use add saturated to prevent overflow */ + l_y1 = opj_uint_min(opj_uint_adds(l_y1, p_cp->tdy), p_image_header->y1); /* use add saturated to prevent overflow */ l_img_comp = p_image_header->comps; for (i = 0; i < p_image_header->numcomps; ++i) { - l_comp_x0 = opj_int_ceildiv(l_x0, (OPJ_INT32)l_img_comp->dx); - l_comp_y0 = opj_int_ceildiv(l_y0, (OPJ_INT32)l_img_comp->dy); - l_comp_x1 = opj_int_ceildiv(l_x1, (OPJ_INT32)l_img_comp->dx); - l_comp_y1 = opj_int_ceildiv(l_y1, (OPJ_INT32)l_img_comp->dy); - l_width = (OPJ_UINT32)opj_int_ceildivpow2(l_comp_x1 - l_comp_x0, (OPJ_INT32)l_img_comp->factor); - l_height = (OPJ_UINT32)opj_int_ceildivpow2(l_comp_y1 - l_comp_y0, (OPJ_INT32)l_img_comp->factor); + l_comp_x0 = opj_uint_ceildiv(l_x0, l_img_comp->dx); + l_comp_y0 = opj_uint_ceildiv(l_y0, l_img_comp->dy); + l_comp_x1 = opj_uint_ceildiv(l_x1, l_img_comp->dx); + l_comp_y1 = opj_uint_ceildiv(l_y1, l_img_comp->dy); + l_width = opj_uint_ceildivpow2(l_comp_x1 - l_comp_x0, l_img_comp->factor); + l_height = opj_uint_ceildivpow2(l_comp_y1 - l_comp_y0, l_img_comp->factor); l_img_comp->w = l_width; l_img_comp->h = l_height; - l_img_comp->x0 = (OPJ_UINT32)l_comp_x0/*l_x0*/; - l_img_comp->y0 = (OPJ_UINT32)l_comp_y0/*l_y0*/; + l_img_comp->x0 = l_comp_x0; + l_img_comp->y0 = l_comp_y0; ++l_img_comp; } } diff --git a/src/lib/openjp2/opj_intmath.h b/src/lib/openjp2/opj_intmath.h index 4e299469..8fa89c03 100644 --- a/src/lib/openjp2/opj_intmath.h +++ b/src/lib/openjp2/opj_intmath.h @@ -137,6 +137,15 @@ Divide an integer by a power of 2 and round upwards static INLINE OPJ_INT32 opj_int_ceildivpow2(OPJ_INT32 a, OPJ_INT32 b) { return (OPJ_INT32)((a + (OPJ_INT64)(1 << b) - 1) >> b); } + +/** + Divide an integer by a power of 2 and round upwards + @return Returns a divided by 2^b + */ +static INLINE OPJ_UINT32 opj_uint_ceildivpow2(OPJ_UINT32 a, OPJ_UINT32 b) { + return (OPJ_UINT32)((a + (OPJ_UINT64)(1U << b) - 1U) >> b); +} + /** Divide an integer by a power of 2 and round downwards @return Returns a divided by 2^b diff --git a/tests/nonregression/md5refs.txt b/tests/nonregression/md5refs.txt index eb04c0ba..caeab6d6 100644 --- a/tests/nonregression/md5refs.txt +++ b/tests/nonregression/md5refs.txt @@ -179,3 +179,6 @@ ec8d1c99db9763a8ba489df4f41dda53 issue411-ycc420.jp2_2.pgx f004b48eafb2e52529cc9c7b6a3ff5d2 issue458.jp2_1.pgx 3127bd0a591d113c3c2428c8d2c14ec8 issue458.jp2_2.pgx dacaf60e4c430916a8c2a9ebec32e71c issue458.jp2_3.pgx +d33fb5dbddb9b9b4438eb51fa27445a3 issue495.jp2_0.pgx +27db8c35e12a5d5eb94d403d2aae2909 issue495.jp2_1.pgx +97da625d2f2d0b75bf891d8083ce8bfb issue495.jp2_2.pgx diff --git a/tests/nonregression/test_suite.ctest.in b/tests/nonregression/test_suite.ctest.in index a8943424..eaaa2e04 100644 --- a/tests/nonregression/test_suite.ctest.in +++ b/tests/nonregression/test_suite.ctest.in @@ -264,6 +264,8 @@ opj_decompress -i @INPUT_NR_PATH@/issue458.jp2 -o @TEMP_PATH@/issue458.jp2.pgx !opj_decompress -i @INPUT_NR_PATH@/issue476.jp2 -o @TEMP_PATH@/issue476.jp2.pgx # issue 475 Invalid number of layers !opj_decompress -i @INPUT_NR_PATH@/issue475.jp2 -o @TEMP_PATH@/issue475.jp2.pgx +# issue 495 Overflow op_image_comp_header_updat +opj_decompress -i @INPUT_NR_PATH@/issue495.jp2 -o @TEMP_PATH@/issue495.jp2.pgx # decode with specific area From 73881d0e5278cb3e7836f3e8cde471464ebc2490 Mon Sep 17 00:00:00 2001 From: Matthieu Darbois Date: Thu, 28 May 2015 22:16:49 +0000 Subject: [PATCH 5/7] [trunk] Fix sscanf format specifier (fixes issue 494) Thanks Aaron. --- src/bin/jp2/opj_compress.c | 4 ++-- src/bin/jp2/opj_decompress.c | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c index 493555db..59d28afb 100644 --- a/src/bin/jp2/opj_compress.c +++ b/src/bin/jp2/opj_compress.c @@ -699,7 +699,7 @@ static int parse_cmdline_encoder(int argc, char **argv, opj_cparameters_t *param OPJ_UINT32 numlayers = 0, numresolution = 0, matrix_width = 0; char *s = opj_optarg; - sscanf(s, "%ud", &numlayers); + sscanf(s, "%u", &numlayers); s++; if (numlayers > 9) s++; @@ -871,7 +871,7 @@ static int parse_cmdline_encoder(int argc, char **argv, opj_cparameters_t *param char *s = opj_optarg; POC = parameters->POC; - while (sscanf(s, "T%ud=%ud,%ud,%ud,%ud,%ud,%4s", &POC[numpocs].tile, + while (sscanf(s, "T%u=%u,%u,%u,%u,%u,%4s", &POC[numpocs].tile, &POC[numpocs].resno0, &POC[numpocs].compno0, &POC[numpocs].layno1, &POC[numpocs].resno1, &POC[numpocs].compno1, POC[numpocs].progorder) == 7) { diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c index a6bc182a..136cc9c1 100644 --- a/src/bin/jp2/opj_decompress.c +++ b/src/bin/jp2/opj_decompress.c @@ -629,7 +629,7 @@ int parse_cmdline_decoder(int argc, char **argv, opj_decompress_parameters *para case 'r': /* reduce option */ { - sscanf(opj_optarg, "%ud", &(parameters->core.cp_reduce)); + sscanf(opj_optarg, "%u", &(parameters->core.cp_reduce)); } break; @@ -638,7 +638,7 @@ int parse_cmdline_decoder(int argc, char **argv, opj_decompress_parameters *para case 'l': /* layering option */ { - sscanf(opj_optarg, "%ud", &(parameters->core.cp_layer)); + sscanf(opj_optarg, "%u", &(parameters->core.cp_layer)); } break; @@ -678,7 +678,7 @@ int parse_cmdline_decoder(int argc, char **argv, opj_decompress_parameters *para case 't': /* Input tile index */ { - sscanf(opj_optarg, "%ud", ¶meters->tile_index); + sscanf(opj_optarg, "%u", ¶meters->tile_index); parameters->nb_tile_to_decode = 1; } break; From 6def7e38b4497b81f9338876548e97e8279c2acd Mon Sep 17 00:00:00 2001 From: Matthieu Darbois Date: Fri, 29 May 2015 21:58:08 +0000 Subject: [PATCH 6/7] [trunk] Fix wrong return value for opj_setup_encoder & opj_set_decoded_resolution_factor (fixes issue 497) Thanks Aaron. --- src/bin/jp2/opj_compress.c | 7 ++++++- src/lib/openjp2/openjpeg.c | 7 ++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c index 59d28afb..e9f3eedf 100644 --- a/src/bin/jp2/opj_compress.c +++ b/src/bin/jp2/opj_compress.c @@ -1768,7 +1768,12 @@ int main(int argc, char **argv) { parameters.cp_tdx = 512; parameters.cp_tdy = 512; } - opj_setup_encoder(l_codec, ¶meters, image); + if (! opj_setup_encoder(l_codec, ¶meters, image)) { + fprintf(stderr, "failed to encode image: opj_setup_encoder\n"); + opj_destroy_codec(l_codec); + opj_image_destroy(image); + return 1; + } /* open a byte stream for writing and allocate memory for all tiles */ l_stream = opj_stream_create_default_file_stream(parameters.outfile,OPJ_FALSE); diff --git a/src/lib/openjp2/openjpeg.c b/src/lib/openjp2/openjpeg.c index 4907c0cf..d5ffb710 100644 --- a/src/lib/openjp2/openjpeg.c +++ b/src/lib/openjp2/openjpeg.c @@ -524,14 +524,12 @@ OPJ_BOOL OPJ_CALLCONV opj_set_decoded_resolution_factor(opj_codec_t *p_codec, opj_codec_private_t * l_codec = (opj_codec_private_t *) p_codec; if ( !l_codec ){ - fprintf(stderr, "[ERROR] Input parameters of the setup_decoder function are incorrect.\n"); return OPJ_FALSE; } - l_codec->m_codec_data.m_decompression.opj_set_decoded_resolution_factor(l_codec->m_codec, + return l_codec->m_codec_data.m_decompression.opj_set_decoded_resolution_factor(l_codec->m_codec, res_factor, &(l_codec->m_event_mgr) ); - return OPJ_TRUE; } /* ---------------------------------------------------------------------- */ @@ -700,11 +698,10 @@ OPJ_BOOL OPJ_CALLCONV opj_setup_encoder(opj_codec_t *p_codec, opj_codec_private_t * l_codec = (opj_codec_private_t *) p_codec; if (! l_codec->is_decompressor) { - l_codec->m_codec_data.m_compression.opj_setup_encoder( l_codec->m_codec, + return l_codec->m_codec_data.m_compression.opj_setup_encoder( l_codec->m_codec, parameters, p_image, &(l_codec->m_event_mgr) ); - return OPJ_TRUE; } } From c0d7afe15c0e88886582a357a4e2fb797ac8a820 Mon Sep 17 00:00:00 2001 From: Matthieu Darbois Date: Wed, 3 Jun 2015 20:56:13 +0000 Subject: [PATCH 7/7] [trunk] Fix offset computations in opj_j2k_update_image_data Update issue 481 --- src/lib/openjp2/j2k.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c index cbdd3688..acb5fd3f 100644 --- a/src/lib/openjp2/j2k.c +++ b/src/lib/openjp2/j2k.c @@ -8009,10 +8009,10 @@ OPJ_BOOL opj_j2k_update_image_data (opj_tcd_t * p_tcd, OPJ_BYTE * p_data, opj_im OPJ_UINT32 l_width_src,l_height_src; OPJ_UINT32 l_width_dest,l_height_dest; OPJ_INT32 l_offset_x0_src, l_offset_y0_src, l_offset_x1_src, l_offset_y1_src; - OPJ_INT32 l_start_offset_src, l_line_offset_src, l_end_offset_src ; + OPJ_SIZE_T l_start_offset_src, l_line_offset_src, l_end_offset_src ; OPJ_UINT32 l_start_x_dest , l_start_y_dest; OPJ_UINT32 l_x0_dest, l_y0_dest, l_x1_dest, l_y1_dest; - OPJ_INT32 l_start_offset_dest, l_line_offset_dest; + OPJ_SIZE_T l_start_offset_dest, l_line_offset_dest; opj_image_comp_t * l_img_comp_src = 00; opj_image_comp_t * l_img_comp_dest = 00; @@ -8034,7 +8034,7 @@ OPJ_BOOL opj_j2k_update_image_data (opj_tcd_t * p_tcd, OPJ_BYTE * p_data, opj_im /* Allocate output component buffer if necessary */ if (!l_img_comp_dest->data) { - l_img_comp_dest->data = (OPJ_INT32*) opj_calloc(l_img_comp_dest->w * l_img_comp_dest->h, sizeof(OPJ_INT32)); + l_img_comp_dest->data = (OPJ_INT32*) opj_calloc((OPJ_SIZE_T)l_img_comp_dest->w * (OPJ_SIZE_T)l_img_comp_dest->h, sizeof(OPJ_INT32)); if (! l_img_comp_dest->data) { return OPJ_FALSE; } @@ -8068,9 +8068,9 @@ OPJ_BOOL opj_j2k_update_image_data (opj_tcd_t * p_tcd, OPJ_BYTE * p_data, opj_im l_height_src = (OPJ_UINT32)(l_res->y1 - l_res->y0); /* Border of the current output component*/ - l_x0_dest = (OPJ_UINT32)opj_int_ceildivpow2((OPJ_INT32)l_img_comp_dest->x0, (OPJ_INT32)l_img_comp_dest->factor); - l_y0_dest = (OPJ_UINT32)opj_int_ceildivpow2((OPJ_INT32)l_img_comp_dest->y0, (OPJ_INT32)l_img_comp_dest->factor); - l_x1_dest = l_x0_dest + l_img_comp_dest->w; + l_x0_dest = opj_uint_ceildivpow2(l_img_comp_dest->x0, l_img_comp_dest->factor); + l_y0_dest = opj_uint_ceildivpow2(l_img_comp_dest->y0, l_img_comp_dest->factor); + l_x1_dest = l_x0_dest + l_img_comp_dest->w; /* can't overflow given that image->x1 is uint32 */ l_y1_dest = l_y0_dest + l_img_comp_dest->h; /*if (i == 0) { @@ -8101,7 +8101,7 @@ OPJ_BOOL opj_j2k_update_image_data (opj_tcd_t * p_tcd, OPJ_BYTE * p_data, opj_im } } else { - l_start_x_dest = 0 ; + l_start_x_dest = 0U; l_offset_x0_src = (OPJ_INT32)l_x0_dest - l_res->x0; if ( l_x1_dest >= (OPJ_UINT32)l_res->x1 ) { @@ -8128,7 +8128,7 @@ OPJ_BOOL opj_j2k_update_image_data (opj_tcd_t * p_tcd, OPJ_BYTE * p_data, opj_im } } else { - l_start_y_dest = 0 ; + l_start_y_dest = 0U; l_offset_y0_src = (OPJ_INT32)l_y0_dest - l_res->y0; if ( l_y1_dest >= (OPJ_UINT32)l_res->y1 ) { @@ -8151,13 +8151,13 @@ OPJ_BOOL opj_j2k_update_image_data (opj_tcd_t * p_tcd, OPJ_BYTE * p_data, opj_im /*-----*/ /* Compute the input buffer offset */ - l_start_offset_src = l_offset_x0_src + l_offset_y0_src * (OPJ_INT32)l_width_src; - l_line_offset_src = l_offset_x1_src + l_offset_x0_src; - l_end_offset_src = l_offset_y1_src * (OPJ_INT32)l_width_src - l_offset_x0_src; + l_start_offset_src = (OPJ_SIZE_T)l_offset_x0_src + (OPJ_SIZE_T)l_offset_y0_src * (OPJ_SIZE_T)l_width_src; + l_line_offset_src = (OPJ_SIZE_T)l_offset_x1_src + (OPJ_SIZE_T)l_offset_x0_src; + l_end_offset_src = (OPJ_SIZE_T)l_offset_y1_src * (OPJ_SIZE_T)l_width_src - (OPJ_SIZE_T)l_offset_x0_src; /* Compute the output buffer offset */ - l_start_offset_dest = (OPJ_INT32)(l_start_x_dest + l_start_y_dest * l_img_comp_dest->w); - l_line_offset_dest = (OPJ_INT32)(l_img_comp_dest->w - l_width_dest); + l_start_offset_dest = (OPJ_SIZE_T)l_start_x_dest + (OPJ_SIZE_T)l_start_y_dest * (OPJ_SIZE_T)l_img_comp_dest->w; + l_line_offset_dest = (OPJ_SIZE_T)l_img_comp_dest->w - (OPJ_SIZE_T)l_width_dest; /* Move the output buffer to the first place where we will write*/ l_dest_ptr = l_img_comp_dest->data + l_start_offset_dest; @@ -9647,7 +9647,7 @@ OPJ_BOOL opj_j2k_decode(opj_j2k_t * p_j2k, if (!p_image) return OPJ_FALSE; - + p_j2k->m_output_image = opj_image_create0(); if (! (p_j2k->m_output_image)) { return OPJ_FALSE;