|
 |
425a81 |
From 1f0dfe5a42911b6880a1445f13f6d615ddb55387 Mon Sep 17 00:00:00 2001
|
|
|
425a81 |
From: Michael Adams <mdadams@ece.uvic.ca>
|
|
|
425a81 |
Date: Fri, 4 Nov 2016 07:20:23 -0700
|
|
|
425a81 |
Subject: [PATCH] Fixed an integer overflow problem in the JPC codec that later
|
|
|
425a81 |
resulted in the use of uninitialized data.
|
|
|
425a81 |
|
|
|
425a81 |
---
|
|
|
425a81 |
src/libjasper/jpc/jpc_t2cod.c | 20 ++++++++++----------
|
|
|
425a81 |
src/libjasper/jpc/jpc_t2cod.h | 20 ++++++++++----------
|
|
|
425a81 |
2 files changed, 20 insertions(+), 20 deletions(-)
|
|
|
425a81 |
|
|
|
425a81 |
diff --git a/src/libjasper/jpc/jpc_t2cod.c b/src/libjasper/jpc/jpc_t2cod.c
|
|
|
425a81 |
index 08315dd..174442a 100644
|
|
|
425a81 |
--- a/src/libjasper/jpc/jpc_t2cod.c
|
|
|
425a81 |
+++ b/src/libjasper/jpc/jpc_t2cod.c
|
|
|
425a81 |
@@ -432,18 +432,18 @@ static int jpc_pi_nextcprl(register jpc_pi_t *pi)
|
|
|
425a81 |
&pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
|
|
|
425a81 |
++pi->picomp) {
|
|
|
425a81 |
pirlvl = pi->picomp->pirlvls;
|
|
|
425a81 |
- pi->xstep = pi->picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
|
|
|
425a81 |
- pi->picomp->numrlvls - 1));
|
|
|
425a81 |
- pi->ystep = pi->picomp->vsamp * (1 << (pirlvl->prcheightexpn +
|
|
|
425a81 |
- pi->picomp->numrlvls - 1));
|
|
|
425a81 |
+ pi->xstep = pi->picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
|
|
|
425a81 |
+ (pirlvl->prcwidthexpn + pi->picomp->numrlvls - 1));
|
|
|
425a81 |
+ pi->ystep = pi->picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
|
|
|
425a81 |
+ (pirlvl->prcheightexpn + pi->picomp->numrlvls - 1));
|
|
|
425a81 |
for (rlvlno = 1, pirlvl = &pi->picomp->pirlvls[1];
|
|
|
425a81 |
rlvlno < pi->picomp->numrlvls; ++rlvlno, ++pirlvl) {
|
|
|
425a81 |
- pi->xstep = JAS_MIN(pi->xstep, pi->picomp->hsamp * (1 <<
|
|
|
425a81 |
- (pirlvl->prcwidthexpn + pi->picomp->numrlvls -
|
|
|
425a81 |
- rlvlno - 1)));
|
|
|
425a81 |
- pi->ystep = JAS_MIN(pi->ystep, pi->picomp->vsamp * (1 <<
|
|
|
425a81 |
- (pirlvl->prcheightexpn + pi->picomp->numrlvls -
|
|
|
425a81 |
- rlvlno - 1)));
|
|
|
425a81 |
+ pi->xstep = JAS_MIN(pi->xstep, pi->picomp->hsamp *
|
|
|
425a81 |
+ (JAS_CAST(uint_fast32_t, 1) << (pirlvl->prcwidthexpn +
|
|
|
425a81 |
+ pi->picomp->numrlvls - rlvlno - 1)));
|
|
|
425a81 |
+ pi->ystep = JAS_MIN(pi->ystep, pi->picomp->vsamp *
|
|
|
425a81 |
+ (JAS_CAST(uint_fast32_t, 1) << (pirlvl->prcheightexpn +
|
|
|
425a81 |
+ pi->picomp->numrlvls - rlvlno - 1)));
|
|
|
425a81 |
}
|
|
|
425a81 |
for (pi->y = pi->ystart; pi->y < pi->yend;
|
|
|
425a81 |
pi->y += pi->ystep - (pi->y % pi->ystep)) {
|
|
|
425a81 |
diff --git a/src/libjasper/jpc/jpc_t2cod.h b/src/libjasper/jpc/jpc_t2cod.h
|
|
|
425a81 |
index 0a176c9..690e031 100644
|
|
|
425a81 |
--- a/src/libjasper/jpc/jpc_t2cod.h
|
|
|
425a81 |
+++ b/src/libjasper/jpc/jpc_t2cod.h
|
|
|
425a81 |
@@ -129,10 +129,10 @@ typedef struct {
|
|
|
425a81 |
jpc_pirlvl_t *pirlvls;
|
|
|
425a81 |
|
|
|
425a81 |
/* The horizontal sampling period. */
|
|
|
425a81 |
- int hsamp;
|
|
|
425a81 |
+ uint_fast32_t hsamp;
|
|
|
425a81 |
|
|
|
425a81 |
/* The vertical sampling period. */
|
|
|
425a81 |
- int vsamp;
|
|
|
425a81 |
+ uint_fast32_t vsamp;
|
|
|
425a81 |
|
|
|
425a81 |
} jpc_picomp_t;
|
|
|
425a81 |
|
|
|
425a81 |
@@ -171,32 +171,32 @@ typedef struct {
|
|
|
425a81 |
int lyrno;
|
|
|
425a81 |
|
|
|
425a81 |
/* The x-coordinate of the current position. */
|
|
|
425a81 |
- int x;
|
|
|
425a81 |
+ uint_fast32_t x;
|
|
|
425a81 |
|
|
|
425a81 |
/* The y-coordinate of the current position. */
|
|
|
425a81 |
- int y;
|
|
|
425a81 |
+ uint_fast32_t y;
|
|
|
425a81 |
|
|
|
425a81 |
/* The horizontal step size. */
|
|
|
425a81 |
- int xstep;
|
|
|
425a81 |
+ uint_fast32_t xstep;
|
|
|
425a81 |
|
|
|
425a81 |
/* The vertical step size. */
|
|
|
425a81 |
- int ystep;
|
|
|
425a81 |
+ uint_fast32_t ystep;
|
|
|
425a81 |
|
|
|
425a81 |
/* The x-coordinate of the top-left corner of the tile on the reference
|
|
|
425a81 |
grid. */
|
|
|
425a81 |
- int xstart;
|
|
|
425a81 |
+ uint_fast32_t xstart;
|
|
|
425a81 |
|
|
|
425a81 |
/* The y-coordinate of the top-left corner of the tile on the reference
|
|
|
425a81 |
grid. */
|
|
|
425a81 |
- int ystart;
|
|
|
425a81 |
+ uint_fast32_t ystart;
|
|
|
425a81 |
|
|
|
425a81 |
/* The x-coordinate of the bottom-right corner of the tile on the
|
|
|
425a81 |
reference grid (plus one). */
|
|
|
425a81 |
- int xend;
|
|
|
425a81 |
+ uint_fast32_t xend;
|
|
|
425a81 |
|
|
|
425a81 |
/* The y-coordinate of the bottom-right corner of the tile on the
|
|
|
425a81 |
reference grid (plus one). */
|
|
|
425a81 |
- int yend;
|
|
|
425a81 |
+ uint_fast32_t yend;
|
|
|
425a81 |
|
|
|
425a81 |
/* The current progression change. */
|
|
|
425a81 |
jpc_pchg_t *pchg;
|