Blame SOURCES/jasper-CVE-2016-2089.patch

83be9e
Backport of the upstream commit:
83be9e
83be9e
From c87ad330a8b8d6e5eb0065675601fdfae08ebaab Mon Sep 17 00:00:00 2001
83be9e
From: Michael Adams <mdadams@ece.uvic.ca>
83be9e
Date: Wed, 12 Oct 2016 11:37:33 -0700
83be9e
Subject: [PATCH] Added fix for CVE-2016-2089.
83be9e
83be9e
diff -pruN jasper-1.900.1.orig/src/libjasper/base/jas_image.c jasper-1.900.1/src/libjasper/base/jas_image.c
83be9e
--- jasper-1.900.1.orig/src/libjasper/base/jas_image.c	2017-03-24 22:40:10.000000000 +0100
83be9e
+++ jasper-1.900.1/src/libjasper/base/jas_image.c	2017-03-24 22:40:51.000000000 +0100
83be9e
@@ -442,6 +442,10 @@ int jas_image_readcmpt(jas_image_t *imag
83be9e
 		return -1;
83be9e
 	}
83be9e
 
83be9e
+	if (!jas_matrix_numrows(data) || !jas_matrix_numcols(data)) {
83be9e
+		return -1;
83be9e
+	}
83be9e
+
83be9e
 	if (jas_matrix_numrows(data) != height || jas_matrix_numcols(data) != width) {
83be9e
 		if (jas_matrix_resize(data, height, width)) {
83be9e
 			return -1;
83be9e
@@ -495,6 +499,10 @@ int jas_image_writecmpt(jas_image_t *ima
83be9e
 		return -1;
83be9e
 	}
83be9e
 
83be9e
+	if (!jas_matrix_numrows(data) || !jas_matrix_numcols(data)) {
83be9e
+		return -1;
83be9e
+	}
83be9e
+
83be9e
 	if (jas_matrix_numrows(data) != height || jas_matrix_numcols(data) != width) {
83be9e
 		return -1;
83be9e
 	}
83be9e
diff -pruN jasper-1.900.1.orig/src/libjasper/base/jas_seq.c jasper-1.900.1/src/libjasper/base/jas_seq.c
83be9e
--- jasper-1.900.1.orig/src/libjasper/base/jas_seq.c	2017-03-24 15:26:36.000000000 +0100
83be9e
+++ jasper-1.900.1/src/libjasper/base/jas_seq.c	2017-03-24 15:28:09.000000000 +0100
83be9e
@@ -266,13 +266,16 @@ void jas_matrix_divpow2(jas_matrix_t *ma
83be9e
 	int rowstep;
83be9e
 	jas_seqent_t *data;
83be9e
 
83be9e
-	rowstep = jas_matrix_rowstep(matrix);
83be9e
-	for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
-	  rowstart += rowstep) {
83be9e
-		for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
-		  ++data) {
83be9e
-			*data = (*data >= 0) ? ((*data) >> n) :
83be9e
-			  (-((-(*data)) >> n));
83be9e
+	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
83be9e
+		assert(matrix->rows_);
83be9e
+		rowstep = jas_matrix_rowstep(matrix);
83be9e
+		for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
+		  rowstart += rowstep) {
83be9e
+			for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
+			  ++data) {
83be9e
+				*data = (*data >= 0) ? ((*data) >> n) :
83be9e
+				  (-((-(*data)) >> n));
83be9e
+			}
83be9e
 		}
83be9e
 	}
83be9e
 }
83be9e
@@ -286,17 +289,20 @@ void jas_matrix_clip(jas_matrix_t *matri
83be9e
 	jas_seqent_t *data;
83be9e
 	int rowstep;
83be9e
 
83be9e
-	rowstep = jas_matrix_rowstep(matrix);
83be9e
-	for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
-	  rowstart += rowstep) {
83be9e
-		data = rowstart;
83be9e
-		for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
-		  ++data) {
83be9e
-			v = *data;
83be9e
-			if (v < minval) {
83be9e
-				*data = minval;
83be9e
-			} else if (v > maxval) {
83be9e
-				*data = maxval;
83be9e
+	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
83be9e
+		assert(matrix->rows_);
83be9e
+		rowstep = jas_matrix_rowstep(matrix);
83be9e
+		for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
+		  rowstart += rowstep) {
83be9e
+			data = rowstart;
83be9e
+			for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
+			  ++data) {
83be9e
+				v = *data;
83be9e
+				if (v < minval) {
83be9e
+					*data = minval;
83be9e
+				} else if (v > maxval) {
83be9e
+					*data = maxval;
83be9e
+				}
83be9e
 			}
83be9e
 		}
83be9e
 	}
83be9e
@@ -311,12 +317,15 @@ void jas_matrix_asr(jas_matrix_t *matrix
83be9e
 	jas_seqent_t *data;
83be9e
 
83be9e
 	assert(n >= 0);
83be9e
-	rowstep = jas_matrix_rowstep(matrix);
83be9e
-	for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
-	  rowstart += rowstep) {
83be9e
-		for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
-		  ++data) {
83be9e
-			*data >>= n;
83be9e
+	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
83be9e
+		assert(matrix->rows_);
83be9e
+		rowstep = jas_matrix_rowstep(matrix);
83be9e
+		for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
+		  rowstart += rowstep) {
83be9e
+			for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
+			  ++data) {
83be9e
+				*data >>= n;
83be9e
+			}
83be9e
 		}
83be9e
 	}
83be9e
 }
83be9e
@@ -329,12 +338,15 @@ void jas_matrix_asl(jas_matrix_t *matrix
83be9e
 	int rowstep;
83be9e
 	jas_seqent_t *data;
83be9e
 
83be9e
-	rowstep = jas_matrix_rowstep(matrix);
83be9e
-	for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
-	  rowstart += rowstep) {
83be9e
-		for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
-		  ++data) {
83be9e
-			*data <<= n;
83be9e
+	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
83be9e
+		assert(matrix->rows_);
83be9e
+		rowstep = jas_matrix_rowstep(matrix);
83be9e
+		for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
+		  rowstart += rowstep) {
83be9e
+			for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
+			  ++data) {
83be9e
+				*data <<= n;
83be9e
+			}
83be9e
 		}
83be9e
 	}
83be9e
 }
83be9e
@@ -371,12 +383,15 @@ void jas_matrix_setall(jas_matrix_t *mat
83be9e
 	int rowstep;
83be9e
 	jas_seqent_t *data;
83be9e
 
83be9e
-	rowstep = jas_matrix_rowstep(matrix);
83be9e
-	for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
-	  rowstart += rowstep) {
83be9e
-		for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
-		  ++data) {
83be9e
-			*data = val;
83be9e
+	if (jas_matrix_numrows(matrix) > 0 && jas_matrix_numcols(matrix) > 0) {
83be9e
+		assert(matrix->rows_);
83be9e
+		rowstep = jas_matrix_rowstep(matrix);
83be9e
+		for (i = matrix->numrows_, rowstart = matrix->rows_[0]; i > 0; --i,
83be9e
+		  rowstart += rowstep) {
83be9e
+			for (j = matrix->numcols_, data = rowstart; j > 0; --j,
83be9e
+			  ++data) {
83be9e
+				*data = val;
83be9e
+			}
83be9e
 		}
83be9e
 	}
83be9e
 }