walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

openjp2/j2k: Validate all SGcod/SPcod/SPcoc parameter values. 

Previously the multiple component transformation SGcod(C)
and wavelet transformation SPcod(H)/SPcoc(E) parameter
values were never checked, allowing for out of range values.

The lack of validation allowed the bit stream provided in
issue #1158 through. After this commit an error message
points to the marker segments' parameters as being out of
range.

input/nonregression/edf_c2_20.jp2 contains an SPcod(H) value
of 17, but according to Table A-20 of the specification only
values 0 and 1 are valid. input/nonregression/issue826.jp2
contains a SGcod(B) value of 2, but according to Table A-17
of the specification only values 0 and 1 are valid.
input/nonregression/oss-fuzz2785.jp2 contains a SGcod(B)
value of 32, but it is likewise limited to 0 or 1. These test
cases have been updated to consistently fail to parse the
headers since they contain out of bounds values.

This fixes issue #1210.
This commit is contained in:
Sebastian Rasmussen 2018-10-31 15:56:11 +01:00
parent d801bd4e62
commit f3ee448815
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/lib/openjp2/j2k.c
View File

@ -2698,6 +2698,12 @@ static OPJ_BOOL opj_j2k_read_cod(opj_j2k_t *p_j2k,
opj_read_bytes(p_header_data, &l_tcp->mct, 1); /* SGcod (C) */ opj_read_bytes(p_header_data, &l_tcp->mct, 1); /* SGcod (C) */
++p_header_data; ++p_header_data;
if (l_tcp->mct > 1) {
opj_event_msg(p_manager, EVT_ERROR,
"Invalid multiple component transformation\n");
return OPJ_FALSE;
}
p_header_size -= 5; p_header_size -= 5;
for (i = 0; i < l_image->numcomps; ++i) { for (i = 0; i < l_image->numcomps; ++i) {
l_tcp->tccps[i].csty = l_tcp->csty & J2K_CCP_CSTY_PRT; l_tcp->tccps[i].csty = l_tcp->csty & J2K_CCP_CSTY_PRT;
@ -9792,6 +9798,12 @@ static OPJ_BOOL opj_j2k_read_SPCod_SPCoc(opj_j2k_t *p_j2k,
opj_read_bytes(l_current_ptr, &l_tccp->qmfbid, 1); opj_read_bytes(l_current_ptr, &l_tccp->qmfbid, 1);
++l_current_ptr; ++l_current_ptr;
if (l_tccp->qmfbid > 1) {
opj_event_msg(p_manager, EVT_ERROR,
"Error reading SPCod SPCoc element, Invalid transformation found\n");
return OPJ_FALSE;
}
*p_header_size = *p_header_size - 5; *p_header_size = *p_header_size - 5;
/* use custom precinct size ? */ /* use custom precinct size ? */

4
tests/nonregression/CMakeLists.txt
View File

@ -34,7 +34,6 @@ set(BLACKLIST_JPEG2000_TMP
edf_c2_1178956.jp2 edf_c2_1178956.jp2
edf_c2_1000290.jp2 edf_c2_1000290.jp2
#edf_c2_1000691.jp2 # ok #edf_c2_1000691.jp2 # ok
#edf_c2_20.jp2 #looks ok as per kdu_jp2info
edf_c2_1377017.jp2 edf_c2_1377017.jp2
edf_c2_1002767.jp2 edf_c2_1002767.jp2
edf_c2_10025.jp2 edf_c2_10025.jp2
@ -61,6 +60,7 @@ set(BLACKLIST_JPEG2000
broken2.jp2 broken2.jp2
broken3.jp2 broken3.jp2
broken4.jp2 broken4.jp2
edf_c2_20.jp2 #may look ok as per kdu_jp2info, but inspection it reveals that the transformation value is out of range
gdal_fuzzer_assert_in_opj_j2k_read_SQcd_SQcc.patch.jp2 gdal_fuzzer_assert_in_opj_j2k_read_SQcd_SQcc.patch.jp2
gdal_fuzzer_check_comp_dx_dy.jp2 gdal_fuzzer_check_comp_dx_dy.jp2
gdal_fuzzer_check_number_of_tiles.jp2 gdal_fuzzer_check_number_of_tiles.jp2
@ -82,6 +82,8 @@ set(BLACKLIST_JPEG2000
issue475.jp2 #kdu_jp2info ok issue475.jp2 #kdu_jp2info ok
issue413.jp2 #kdu_jp2info ok issue413.jp2 #kdu_jp2info ok
issue823.jp2 #kdu_jp2info ok issue823.jp2 #kdu_jp2info ok
issue826.jp2 #inspection reveales that the transformation value is out of range
oss-fuzz2785.jp2 #inspection reveales that the transformation value is out of range
) )
file(GLOB_RECURSE OPJ_DATA_NR_LIST file(GLOB_RECURSE OPJ_DATA_NR_LIST