|
 |
425a81 |
Backport of the upstream commit:
|
|
|
425a81 |
|
|
|
425a81 |
From 2e82fa00466ae525339754bb3ab0a0474a31d4bd Mon Sep 17 00:00:00 2001
|
|
|
425a81 |
From: Michael Adams <mdadams@ece.uvic.ca>
|
|
|
425a81 |
Date: Wed, 19 Oct 2016 17:57:40 -0700
|
|
|
425a81 |
Subject: [PATCH] Fixed an integral type promotion problem by adding a
|
|
|
425a81 |
JAS_CAST. Modified the jpc_tsfb_synthesize function so that it will be a noop
|
|
|
425a81 |
for an empty sequence (in order to avoid dereferencing a null pointer).
|
|
|
425a81 |
|
|
|
425a81 |
diff -pruN jasper-1.900.1.orig/src/libjasper/include/jasper/jas_math.h jasper-1.900.1/src/libjasper/include/jasper/jas_math.h
|
|
|
425a81 |
--- jasper-1.900.1.orig/src/libjasper/include/jasper/jas_math.h 2017-03-31 14:08:18.000000000 +0200
|
|
|
425a81 |
+++ jasper-1.900.1/src/libjasper/include/jasper/jas_math.h 2017-03-31 14:09:06.000000000 +0200
|
|
|
425a81 |
@@ -115,6 +115,24 @@ extern "C" {
|
|
|
425a81 |
((1 << (n)) - 1)
|
|
|
425a81 |
|
|
|
425a81 |
/******************************************************************************\
|
|
|
425a81 |
+*
|
|
|
425a81 |
+\******************************************************************************/
|
|
|
425a81 |
+
|
|
|
425a81 |
+__attribute__((no_sanitize("undefined")))
|
|
|
425a81 |
+inline static jas_int_asr(int x, int n)
|
|
|
425a81 |
+{
|
|
|
425a81 |
+ assert(n >= 0);
|
|
|
425a81 |
+ return x >> n;
|
|
|
425a81 |
+}
|
|
|
425a81 |
+
|
|
|
425a81 |
+__attribute__((no_sanitize("undefined")))
|
|
|
425a81 |
+inline static jas_int_asl(int x, int n)
|
|
|
425a81 |
+{
|
|
|
425a81 |
+ assert(n >= 0);
|
|
|
425a81 |
+ return x << n;
|
|
|
425a81 |
+}
|
|
|
425a81 |
+
|
|
|
425a81 |
+/******************************************************************************\
|
|
|
425a81 |
* Safe integer arithmetic (i.e., with overflow checking).
|
|
|
425a81 |
\******************************************************************************/
|
|
|
425a81 |
|
|
|
425a81 |
diff -pruN jasper-1.900.1.orig/src/libjasper/include/jasper/jas_seq.h jasper-1.900.1/src/libjasper/include/jasper/jas_seq.h
|
|
|
425a81 |
--- jasper-1.900.1.orig/src/libjasper/include/jasper/jas_seq.h 2007-01-19 22:43:04.000000000 +0100
|
|
|
425a81 |
+++ jasper-1.900.1/src/libjasper/include/jasper/jas_seq.h 2017-03-31 14:09:06.000000000 +0200
|
|
|
425a81 |
@@ -154,6 +154,9 @@ typedef jas_matrix_t jas_seq_t;
|
|
|
425a81 |
#define jas_matrix_numcols(matrix) \
|
|
|
425a81 |
((matrix)->numcols_)
|
|
|
425a81 |
|
|
|
425a81 |
+#define jas_matrix_size(matrix) \
|
|
|
425a81 |
+ (jas_matrix_width(matrix) * jas_matrix_height(matrix))
|
|
|
425a81 |
+
|
|
|
425a81 |
/* Get a matrix element. */
|
|
|
425a81 |
#define jas_matrix_get(matrix, i, j) \
|
|
|
425a81 |
((matrix)->rows_[i][j])
|
|
|
425a81 |
@@ -269,6 +272,8 @@ jas_matrix_t *jas_seq2d_create(int xstar
|
|
|
425a81 |
((s)->xstart_ = (x), (s)->ystart_ = (y), \
|
|
|
425a81 |
(s)->xend_ = (s)->xstart_ + (s)->numcols_, \
|
|
|
425a81 |
(s)->yend_ = (s)->ystart_ + (s)->numrows_)
|
|
|
425a81 |
+#define jas_seq2d_size(s) \
|
|
|
425a81 |
+ (jas_seq2d_width(s) * jas_seq2d_height(s))
|
|
|
425a81 |
|
|
|
425a81 |
void jas_seq2d_bindsub(jas_matrix_t *s, jas_matrix_t *s1, int xstart,
|
|
|
425a81 |
int ystart, int xend, int yend);
|
|
|
425a81 |
diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c jasper-1.900.1/src/libjasper/jpc/jpc_dec.c
|
|
|
425a81 |
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c 2017-03-31 14:08:18.000000000 +0200
|
|
|
425a81 |
+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c 2017-03-31 14:09:06.000000000 +0200
|
|
|
425a81 |
@@ -1805,6 +1805,13 @@ static void jpc_undo_roi(jas_matrix_t *x
|
|
|
425a81 |
bool warn;
|
|
|
425a81 |
uint_fast32_t mask;
|
|
|
425a81 |
|
|
|
425a81 |
+ if (roishift < 0) {
|
|
|
425a81 |
+ /* We could instead return an error here. */
|
|
|
425a81 |
+ /* I do not think it matters much. */
|
|
|
425a81 |
+ jas_eprintf("warning: forcing negative ROI shift to zero "
|
|
|
425a81 |
+ "(bitstream is probably corrupt)\n");
|
|
|
425a81 |
+ roishift = 0;
|
|
|
425a81 |
+ }
|
|
|
425a81 |
if (roishift == 0 && bgshift == 0) {
|
|
|
425a81 |
return;
|
|
|
425a81 |
}
|
|
|
425a81 |
@@ -1823,7 +1830,7 @@ static void jpc_undo_roi(jas_matrix_t *x
|
|
|
425a81 |
} else {
|
|
|
425a81 |
/* We are dealing with non-ROI (i.e., background) data. */
|
|
|
425a81 |
mag <<= bgshift;
|
|
|
425a81 |
- mask = (1 << numbps) - 1;
|
|
|
425a81 |
+ mask = (JAS_CAST(uint_fast32_t, 1) << numbps) - 1;
|
|
|
425a81 |
/* Perform a basic sanity check on the sample value. */
|
|
|
425a81 |
/* Some implementations write garbage in the unused
|
|
|
425a81 |
most-significant bit planes introduced by ROI shifting.
|
|
|
425a81 |
diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_tsfb.c jasper-1.900.1/src/libjasper/jpc/jpc_tsfb.c
|
|
|
425a81 |
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_tsfb.c 2007-01-19 22:43:07.000000000 +0100
|
|
|
425a81 |
+++ jasper-1.900.1/src/libjasper/jpc/jpc_tsfb.c 2017-03-31 14:09:06.000000000 +0200
|
|
|
425a81 |
@@ -148,7 +148,8 @@ int jpc_tsfb_analyze2(jpc_tsfb_t *tsfb,
|
|
|
425a81 |
|
|
|
425a81 |
int jpc_tsfb_synthesize(jpc_tsfb_t *tsfb, jas_seq2d_t *a)
|
|
|
425a81 |
{
|
|
|
425a81 |
- return (tsfb->numlvls > 0) ? jpc_tsfb_synthesize2(tsfb,
|
|
|
425a81 |
+ return (tsfb->numlvls > 0 && jas_seq2d_size(a)) ?
|
|
|
425a81 |
+ jpc_tsfb_synthesize2(tsfb,
|
|
|
425a81 |
jas_seq2d_getref(a, jas_seq2d_xstart(a), jas_seq2d_ystart(a)),
|
|
|
425a81 |
jas_seq2d_xstart(a), jas_seq2d_ystart(a), jas_seq2d_width(a),
|
|
|
425a81 |
jas_seq2d_height(a), jas_seq2d_rowstep(a), tsfb->numlvls - 1) : 0;
|