walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

[trunk] fixed a possible overflow in opj_t1_encode_cblks call to opj_int_fix_mul (fixes issue 141)

This commit is contained in:
Matthieu Darbois 2014-12-20 13:03:11 +00:00
parent a504edf724
commit e966fef3eb
2 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/lib/openjp2/opj_intmath.h
View File

@ -117,6 +117,7 @@ Divide an integer and round upwards
@return Returns a divided by b
*/
static INLINE OPJ_UINT32 opj_uint_ceildiv(OPJ_UINT32 a, OPJ_UINT32 b) {
assert(b);
return (a + b - 1) / b;
}
@ -167,7 +168,17 @@ Multiply two fixed-precision rational numbers.
static INLINE OPJ_INT32 opj_int_fix_mul(OPJ_INT32 a, OPJ_INT32 b) {
OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ;
temp += 4096;
return (OPJ_INT32) (temp >> 13) ;
assert((temp >> 13) <= (OPJ_INT64)0x7FFFFFFF);
assert((temp >> 13) >= (-(OPJ_INT64)0x7FFFFFFF - (OPJ_INT64)1));
return (OPJ_INT32) (temp >> 13);
}
static INLINE OPJ_INT32 opj_int_fix_mul_t1(OPJ_INT32 a, OPJ_INT32 b) {
OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ;
temp += 4096;
assert((temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) <= (OPJ_INT64)0x7FFFFFFF);
assert((temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) >= (-(OPJ_INT64)0x7FFFFFFF - (OPJ_INT64)1));
return (OPJ_INT32) (temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) ;
}
/* ----------------------------------------------------------------------- */

4
src/lib/openjp2/t1.c
View File

@ -1534,9 +1534,9 @@ OPJ_BOOL opj_t1_encode_cblks( opj_t1_t *t1,
for (i = 0; i < cblk_w; ++i) {
OPJ_INT32 tmp = tiledp[tileIndex];
tiledp[tileIndex] =
opj_int_fix_mul(
opj_int_fix_mul_t1(
tmp,
bandconst) >> (11 - T1_NMSEDEC_FRACBITS);
bandconst);
tileIndex++;
}
tileIndex += tileLineAdvance;