walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

[trunk] fixed a possible overflow in opj_t1_encode_cblks call to opj_int_fix_mul (fixes issue 141)

This commit is contained in:
Matthieu Darbois 2014-12-20 13:03:11 +00:00
parent a504edf724
commit e966fef3eb
2 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/lib/openjp2/opj_intmath.h
View File

@ -108,7 +108,7 @@ Divide an integer and round upwards
@return Returns a divided by b @return Returns a divided by b
*/ */
static INLINE OPJ_INT32 opj_int_ceildiv(OPJ_INT32 a, OPJ_INT32 b) { static INLINE OPJ_INT32 opj_int_ceildiv(OPJ_INT32 a, OPJ_INT32 b) {
assert(b); assert(b);
return (a + b - 1) / b; return (a + b - 1) / b;
} }
@ -117,6 +117,7 @@ Divide an integer and round upwards
@return Returns a divided by b @return Returns a divided by b
*/ */
static INLINE OPJ_UINT32 opj_uint_ceildiv(OPJ_UINT32 a, OPJ_UINT32 b) { static INLINE OPJ_UINT32 opj_uint_ceildiv(OPJ_UINT32 a, OPJ_UINT32 b) {
assert(b);
return (a + b - 1) / b; return (a + b - 1) / b;
} }
@ -165,9 +166,19 @@ Multiply two fixed-precision rational numbers.
@return Returns a * b @return Returns a * b
*/ */
static INLINE OPJ_INT32 opj_int_fix_mul(OPJ_INT32 a, OPJ_INT32 b) { static INLINE OPJ_INT32 opj_int_fix_mul(OPJ_INT32 a, OPJ_INT32 b) {
OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ; OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ;
temp += 4096; temp += 4096;
return (OPJ_INT32) (temp >> 13) ; assert((temp >> 13) <= (OPJ_INT64)0x7FFFFFFF);
assert((temp >> 13) >= (-(OPJ_INT64)0x7FFFFFFF - (OPJ_INT64)1));
return (OPJ_INT32) (temp >> 13);
}
static INLINE OPJ_INT32 opj_int_fix_mul_t1(OPJ_INT32 a, OPJ_INT32 b) {
OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ;
temp += 4096;
assert((temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) <= (OPJ_INT64)0x7FFFFFFF);
assert((temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) >= (-(OPJ_INT64)0x7FFFFFFF - (OPJ_INT64)1));
return (OPJ_INT32) (temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) ;
} }
/* ----------------------------------------------------------------------- */ /* ----------------------------------------------------------------------- */

4
src/lib/openjp2/t1.c
View File

@ -1534,9 +1534,9 @@ OPJ_BOOL opj_t1_encode_cblks( opj_t1_t *t1,
for (i = 0; i < cblk_w; ++i) { for (i = 0; i < cblk_w; ++i) {
OPJ_INT32 tmp = tiledp[tileIndex]; OPJ_INT32 tmp = tiledp[tileIndex];
tiledp[tileIndex] = tiledp[tileIndex] =
opj_int_fix_mul( opj_int_fix_mul_t1(
tmp, tmp,
bandconst) >> (11 - T1_NMSEDEC_FRACBITS); bandconst);
tileIndex++; tileIndex++;
} }
tileIndex += tileLineAdvance; tileIndex += tileLineAdvance;