Blame SOURCES/jasper-CVE-2016-9389.patch

94b862
Backport of upstream commit:
94b862
94b862
From dee11ec440d7908d1daf69f40a3324b27cf213ba Mon Sep 17 00:00:00 2001
94b862
From: Michael Adams <mdadams@ece.uvic.ca>
94b862
Date: Mon, 24 Oct 2016 07:26:40 -0700
94b862
Subject: [PATCH] The component domains must be the same for the ICT/RCT in the
94b862
 JPC codec. This was previously enforced with an assertion. Now, it is handled
94b862
 in a more graceful manner.
94b862
94b862
diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c jasper-1.900.1/src/libjasper/jpc/jpc_dec.c
94b862
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c	2017-03-31 22:20:39.000000000 +0200
94b862
+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c	2017-03-31 22:48:55.368931732 +0200
94b862
@@ -1014,6 +1014,24 @@ if (!prc->cblks) {
94b862
 	return 0;
94b862
 }
94b862
 
94b862
+static int jas_image_cmpt_domains_same(jas_image_t *image)
94b862
+{
94b862
+	int cmptno;
94b862
+	jas_image_cmpt_t *cmpt;
94b862
+	jas_image_cmpt_t *cmpt0;
94b862
+
94b862
+	cmpt0 = image->cmpts_[0];
94b862
+	for (cmptno = 1; cmptno < image->numcmpts_; ++cmptno) {
94b862
+		cmpt = image->cmpts_[cmptno];
94b862
+		if (cmpt->tlx_ != cmpt0->tlx_ || cmpt->tly_ != cmpt0->tly_ ||
94b862
+		  cmpt->hstep_ != cmpt0->hstep_ || cmpt->vstep_ != cmpt0->vstep_ ||
94b862
+		  cmpt->width_ != cmpt0->width_ || cmpt->height_ != cmpt0->height_) {
94b862
+			return 0;
94b862
+		}
94b862
+	}
94b862
+	return 1;
94b862
+}
94b862
+
94b862
 static int jpc_dec_tiledecode(jpc_dec_t *dec, jpc_dec_tile_t *tile)
94b862
 {
94b862
 	int i;
94b862
@@ -1074,6 +1092,10 @@ static int jpc_dec_tiledecode(jpc_dec_t
94b862
 			jas_eprintf("RCT requires at least three components\n");
94b862
 			return -1;
94b862
 		}
94b862
+		if (!jas_image_cmpt_domains_same(dec->image)) {
94b862
+			jas_eprintf("RCT requires all components have the same domain\n");
94b862
+			return -1;
94b862
+		}
94b862
 		jpc_irct(tile->tcomps[0].data, tile->tcomps[1].data,
94b862
 		  tile->tcomps[2].data);
94b862
 		break;
94b862
@@ -1082,6 +1104,10 @@ static int jpc_dec_tiledecode(jpc_dec_t
94b862
 			jas_eprintf("ICT requires at least three components\n");
94b862
 			return -1;
94b862
 		}
94b862
+		if (!jas_image_cmpt_domains_same(dec->image)) {
94b862
+			jas_eprintf("RCT requires all components have the same domain\n");
94b862
+			return -1;
94b862
+		}
94b862
 		jpc_iict(tile->tcomps[0].data, tile->tcomps[1].data,
94b862
 		  tile->tcomps[2].data);
94b862
 		break;