Commit Graph

2942 Commits

Author SHA1 Message Date
Young_X ce9583d1d7 [JPWL] opj_compress: reorder checks related to code block dimensions to avoid potential int overflow
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-28 14:39:14 +08:00
Young_X c58df14990 [OPENJP2] change the way to compute *p_tx0, *p_tx1, *p_ty0, *p_ty1 in function
opj_get_encoding_parameters

Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-28 14:39:14 +08:00
Young_X c277159986 [MJ2] Avoid index out of bounds access to pi->include[]
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-28 14:39:14 +08:00
Even Rouault e0f5212888
Merge pull request #1170 from rouault/fix_color_apply_icc_profile
color_apply_icc_profile: avoid potential heap buffer overflow
2018-11-28 00:04:30 +01:00
Even Rouault 2e5ab1d998
color_apply_icc_profile: avoid potential heap buffer overflow
Derived from a patch by Thuan Pham
2018-11-27 23:31:30 +01:00
Young_X 46822d0edd [JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987)
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-23 17:08:57 +08:00
Young_X 619e1b086e [JPWL] fix CVE-2018-16375
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-23 17:08:56 +08:00
Young_X c5bd64ea14 [MJ2] To avoid divisions by zero / undefined behaviour on shift
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-23 14:47:36 +08:00
Even Rouault 92023cd6c3
Merge pull request #1160 from hlef/master
jp3d/jpwl convert: fix write stack buffer overflow
2018-11-16 09:42:19 +01:00
ichlubna c196b23b90 openjp3d: Int overflow fixed (#1159)
When compressing a lot of slices (starting from 44 FullHD slices with 3 8bit components in our experiments) the rate values are high enough to cause an int overflow that leads to negative lengths and wrong results. The cast happens too late.
2018-11-16 09:40:31 +01:00
Hugo Lefeuvre cab352e249 jp2: convert: fix null pointer dereference
Tile components in a JP2 image might have null data pointer by defining a
zero component size (for example using large horizontal or vertical
sampling periods). This null data pointer leads to null image component
data pointer, causing crash when dereferenced without != null check in
imagetopnm.

Add != null check.

This commit addresses #1152 (CVE-2018-18088).
2018-11-07 18:53:18 +01:00
Hugo Lefeuvre 0bc90e4062 jp3d/jpwl convert: fix write stack buffer overflow
Missing buffer length formatter in fscanf call might lead to write
stack buffer overflow.

fixes #1044 (CVE-2017-17480)
2018-11-01 09:05:26 +01:00
Stefan Weil 948332e6ed Fix some potential overflow issues (#1161)
* Fix some potential overflow issues

Put sizeof to the beginning of the multiplication to enforce that
size_t instead of smaller integer types is used for the calculation.

This fixes warnings from LGTM:

    Multiplication result may overflow 'unsigned int'
    before it is converted to 'unsigned long'.

It also allows removing some type casts.

Signed-off-by: Stefan Weil <sw@weilnetz.de>

* Fix code indentation

Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-10-31 20:44:30 +01:00
Even Rouault e52909f4c7
Merge pull request #1163 from nforro/memory-and-resource-leaks
Fix several memory and resource leaks
2018-10-31 20:41:52 +01:00
Nikola Forró 943db0f1c2 Fix several memory and resource leaks
Signed-off-by: Nikola Forró <nforro@redhat.com>
2018-10-31 16:16:22 +01:00
Even Rouault cd900d9661
opj_thread_pool_setup(): fix infinite waiting if a thread creation failed 2018-10-18 11:45:45 +02:00
Even Rouault 0e6a5553cf
Merge pull request #1148 from hlef/master
CVE-2018-5785: fix issues with zero bitmasks
2018-09-22 23:54:12 +02:00
Even Rouault 8fc09e50e5
opj_jp2_apply_pclr(): remove useless assert that can trigger on some files (fixes #1125) 2018-09-22 23:47:56 +02:00
Even Rouault aaf48ee6ba
Merge branch 'pr1095' 2018-09-22 23:12:50 +02:00
Karol Babioch cc3824767b
opj_mj2_extract: Check provided output prefix for length
This uses snprintf() with correct buffer length instead of sprintf(), which
prevents a buffer overflow when providing a long output prefix. Furthermore
the program exits with an error when the provided output prefix is too long.

Fixes #1088.
2018-09-22 23:12:39 +02:00
Even Rouault ee827ad3f3
Merge branch 'pr1107' 2018-09-22 23:05:54 +02:00
szukw000 1eb9a57ac1
opj_mj2_extract: Avoid segfault for long filenames 2018-09-22 23:05:38 +02:00
Even Rouault 5d94bcd89c
Merge pull request #1136 from reverson/master
Cast on uint ceildiv
2018-09-22 22:59:36 +02:00
Even Rouault b54c06fb35
Merge pull request #1119 from stweil/ssize_t
Use local type declaration for POSIX standard type only for MS compiler
2018-09-22 22:59:17 +02:00
Even Rouault 17bbb0e23f
Merge pull request #1128 from stweil/typos
Fix some typos in code comments and documentation
2018-09-22 22:55:33 +02:00
Even Rouault ccc4441aeb
Merge pull request #1140 from bukatlib/fix_relpath
Relative path to header files is hardcoded in OpenJPEGConfig.cmake.in file
2018-09-22 22:54:51 +02:00
Even Rouault c6ee006250
Merge pull request #1141 from szukw000/changes-in-pnmtoimage
Changes in pnmtoimage if image data are missing
2018-09-22 22:47:27 +02:00
Even Rouault 2d2861036c
Merge pull request #1143 from stweil/format
openjp2/jp2: Fix two format strings
2018-09-22 22:28:04 +02:00
Even Rouault 1b9a81dff7
Merge pull request #1149 from rouault/fix_knownfailures
Update knownfailures- files given current configurations
2018-09-22 22:27:14 +02:00
Even Rouault c28ed52163
Update knownfailures- files given current configurations 2018-09-22 21:56:50 +02:00
Hugo Lefeuvre ca16fe5501 convertbmp: fix issues with zero bitmasks
In the case where a BMP file declares compression 3 (BI_BITFIELDS)
with header size <= 56, all bitmask values keep their initialization
value 0. This may lead to various undefined behavior later e.g. when
doing 1 << (l_comp->prec - 1).

This issue does not affect files with bit count 16 because of a check
added in 16240e2 which sets default values to the color masks if they
are all 0.

This commit adds similar checks for the 32 bit case.

Also, if a BMP file declares compression 3 with header size >= 56 and
intentional 0 bitmasks, the same issue will be triggered in both the
16 and 32 bit count case.

This commit adds checks to bmp_read_info_header() rejecting BMP files
with "intentional" 0 bitmasks. These checks might be removed in the
future when proper handling of zero bitmasks will be available in
openjpeg2.

fixes #1057 (CVE-2018-5785)
2018-09-22 14:51:50 -04:00
Stefan Weil 31a03b390a openjp2/jp2: Fix two format strings
Compiler warnings:

src/lib/openjp2/jp2.c:1008:35: warning:
 too many arguments for format [-Wformat-extra-args]
src/lib/openjp2/j2k.c:1928:73: warning:
 format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘OPJ_OFF_T {aka long int}’ [-Wformat=]

Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-09-05 21:52:43 +02:00
Stefan Weil 3d6ffaf3f3 Fix some typos in code comments and documentation
All typos were found by Codespell.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-09-05 20:01:10 +02:00
szukw000 98363e244e Changes in pnmtoimage if image data are missing 2018-08-31 16:24:41 +02:00
Libor Bukata 24fd3ce777 The change makes a relative path to header files
always correct regardless of the number of sub-
directories in OPENJPEG_INSTALL_PACKAGE_DIR variable.
2018-08-31 12:57:40 +02:00
Robert Everson 0fa7ebe254 Cast on uint ceildiv 2018-08-27 15:28:53 -07:00
Even Rouault 9d1a9dc20d
Merge pull request #1133 from robe2/robe2-pkgconfig-instructions
Add -DBUILD_PKGCONFIG_FILES to install instructions
2018-08-11 23:35:35 +02:00
Regina Obe 56f23b29a0
Add -DBUILD_PKGCONFIG_FILES to install instructions
Building under msys/mingw doesn't automatically install the pkg config files needed to build GDAL and other libraries
2018-08-11 16:59:30 -04:00
Even Rouault d2205ba2ee
Merge pull request #1121 from rouault/fix_tnsot_zero
Fix regression in reading files with TNsot == 0 (refs #1120)
2018-06-20 16:26:24 +02:00
Even Rouault 4170681661
Add test cases for https://github.com/uclouvain/openjpeg/issues/1120 and https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2785 2018-06-20 15:28:53 +02:00
Even Rouault 0c913b0aba
Avoid assertion when running opj_j2k_merge_ppt() several time due to e6674f7ed66abdb32a0be5944f618722b6a7b5d5 revert. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2785 2018-06-20 15:12:47 +02:00
Even Rouault 832dfd1866
Revert "Avoid assertion in opj_j2k_merge_ppt() in case premature EOC is encountered in opj_j2k_read_tile_header(). Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2785. Credit to OSS Fuzz" (fixes #1120)
This reverts commit 9906fbf737.
which broke decoding of images where TNsot == 0
2018-06-20 14:54:20 +02:00
Stefan Weil 4aaf52ec8d Use local type declaration for POSIX standard type only for MS compiler
ssize_t is a POSIX type which is declared in POSIX include files.
Mingw-w64 provides it also for Windows.

Use the local declaration only with MS compilers.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-06-18 14:48:08 +02:00
Even Rouault fd205f457b
opj_compress: try to make help message of -c switch clearer (fixes #1117) 2018-06-16 16:17:58 +02:00
Even Rouault 2c7eb4fed9 opj_compress: fix help message regarding default precinct size 2018-03-12 14:24:20 +01:00
Even Rouault a59512e099
Merge pull request #1104 from rouault/macos_fix
Fix Mac builds
2018-03-04 23:54:09 +01:00
Even Rouault 8ad94f689e Fix Mac builds 2018-03-04 23:30:53 +01:00
Even Rouault 3910be8a68
Merge pull request #1062 from radarhere/master
Fixed typos
2018-03-04 23:19:59 +01:00
Even Rouault e98d0a20f0
Merge pull request #1094 from kbabioch/fix/missing-format-string-parameter
mj2: Add missing variable to format string in fprintf() invocation in meta_out.c
2018-03-04 23:16:04 +01:00
Even Rouault 31a347a9a0
Merge pull request #1096 from kbabioch/fix/opj_mj2_extract-help
opj_mj2_extract: Rename output_location to output_prefix
2018-03-04 23:13:45 +01:00