From d8c2604cd438c41ec72aff52c16ebd8183068020 Mon Sep 17 00:00:00 2001

From: Michael Adams <mdadams@ece.uvic.ca>

Date: Sat, 15 Oct 2016 12:22:28 -0700

Subject: [PATCH] Added range check on XRsiz and YRsiz fields of SIZ marker

 segment.

---

 src/libjasper/jpc/jpc_cs.c | 10 ++++++++++

 1 file changed, 10 insertions(+)

diff --git a/src/libjasper/jpc/jpc_cs.c b/src/libjasper/jpc/jpc_cs.c

index 6da4872..55d34d6 100644

--- a/src/libjasper/jpc/jpc_cs.c

+++ b/src/libjasper/jpc/jpc_cs.c

@@ -512,6 +512,16 @@ static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate,

 			jas_free(siz->comps);

 			return -1;

 		}

+		if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {

+			jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);

+			jas_free(siz->comps);

+			return -1;

+		}

+		if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {

+			jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);

+			jas_free(siz->comps);

+			return -1;

+		}

 		siz->comps[i].sgnd = (tmp >> 7) & 1;

 		siz->comps[i].prec = (tmp & 0x7f) + 1;

 	}