Commit Graph

21 Commits

Author SHA1 Message Date
Stefan Weil 948332e6ed Fix some potential overflow issues (#1161)
* Fix some potential overflow issues

Put sizeof to the beginning of the multiplication to enforce that
size_t instead of smaller integer types is used for the calculation.

This fixes warnings from LGTM:

    Multiplication result may overflow 'unsigned int'
    before it is converted to 'unsigned long'.

It also allows removing some type casts.

Signed-off-by: Stefan Weil <sw@weilnetz.de>

* Fix code indentation

Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-10-31 20:44:30 +01:00
Hugo Lefeuvre ca16fe5501 convertbmp: fix issues with zero bitmasks
In the case where a BMP file declares compression 3 (BI_BITFIELDS)
with header size <= 56, all bitmask values keep their initialization
value 0. This may lead to various undefined behavior later e.g. when
doing 1 << (l_comp->prec - 1).

This issue does not affect files with bit count 16 because of a check
added in 16240e2 which sets default values to the color masks if they
are all 0.

This commit adds similar checks for the 32 bit case.

Also, if a BMP file declares compression 3 with header size >= 56 and
intentional 0 bitmasks, the same issue will be triggered in both the
16 and 32 bit count case.

This commit adds checks to bmp_read_info_header() rejecting BMP files
with "intentional" 0 bitmasks. These checks might be removed in the
future when proper handling of zero bitmasks will be available in
openjpeg2.

fixes #1057 (CVE-2018-5785)
2018-09-22 14:51:50 -04:00
Even Rouault 5597522cac bmp_read_rle8_data(): avoid potential infinite loop (#996) 2017-08-18 10:16:38 +02:00
Even Rouault baf0c1ad45 bmp_read_info_header(): reject bmp files with biBitCount == 0 (#983) 2017-08-14 17:26:58 +02:00
Even Rouault 5a560ebf51 imagetobmp: avoid shift by -1 (relates to #811) 2017-08-09 09:42:30 +02:00
szukw000 00f45684a8 Catch images broken by AFL 2017-07-31 13:58:08 +02:00
Even Rouault 5e795d90a1 Spelling fixes (patch by ka7, #890, rebased on top of master) 2017-07-26 21:06:38 +02:00
Even Rouault 563bd8499e Reformat whole codebase with astyle.options (#128) 2017-05-09 20:46:20 +02:00
trylab 893143c8e1 Fix issue 833.
Add some overflow check operations.
2016-09-13 17:43:30 +08:00
Matthieu Darbois 15f081c896 Fix Out-Of-Bounds Read in sycc42x_to_rgb function (#745)
42x Images with an odd x0/y0 lead to subsampled component starting at the
2nd column/line.
That is offset = comp->dx * comp->x0 - image->x0 = 1

Fix #726
2016-04-30 00:33:27 +02:00
julienmalik 319fc971fe cppcheck fix for openjp2 (#740) 2016-04-29 23:49:17 +02:00
mayeut b9ca882749 Fix resource leaks & unchecked resource allocations 2015-09-25 00:08:34 +02:00
mayeut f9df8ba19a Fix some resource leaks 2015-09-24 23:32:03 +02:00
mayeut faf63fddad Fix warning in rle4 decoding 2015-09-23 21:09:19 +02:00
mayeut 8a95efcd3f Fix some UBSan warnings 2015-08-23 11:43:38 +02:00
mayeut c423cc84e7 Remove some warnings when building
Update #442
2015-07-26 02:41:39 +02:00
Matthieu Darbois 42132ed6b5 [trunk] removed warning from convertbmp.c
Update  issue 442
2014-12-27 11:31:43 +00:00
Matthieu Darbois 4a09296771 [trunk] removed warning from convertbmp.c
Update  issue 442
2014-12-23 10:13:28 +00:00
Matthieu Darbois 16240e21f9 [trunk] updated BMP format input support
Update  issue 203
2014-12-22 14:40:31 +00:00
Matthieu Darbois 33a0e66eb1 [trunk] updated BMP format input support
Update  issue 203
2014-12-22 13:14:37 +00:00
Matthieu Darbois f1bae45c76 [trunk] fixed BMP reading for 8bpp when width & 3 == 1
Update  issue 203
2014-12-20 18:45:53 +00:00