Blame SOURCES/jasper-CVE-2016-9389.patch

425a81
Backport of upstream commit:
425a81
425a81
From dee11ec440d7908d1daf69f40a3324b27cf213ba Mon Sep 17 00:00:00 2001
425a81
From: Michael Adams <mdadams@ece.uvic.ca>
425a81
Date: Mon, 24 Oct 2016 07:26:40 -0700
425a81
Subject: [PATCH] The component domains must be the same for the ICT/RCT in the
425a81
 JPC codec. This was previously enforced with an assertion. Now, it is handled
425a81
 in a more graceful manner.
425a81
425a81
diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c jasper-1.900.1/src/libjasper/jpc/jpc_dec.c
425a81
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c	2017-03-31 22:20:39.000000000 +0200
425a81
+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c	2017-03-31 22:48:55.368931732 +0200
425a81
@@ -1014,6 +1014,24 @@ if (!prc->cblks) {
425a81
 	return 0;
425a81
 }
425a81
 
425a81
+static int jas_image_cmpt_domains_same(jas_image_t *image)
425a81
+{
425a81
+	int cmptno;
425a81
+	jas_image_cmpt_t *cmpt;
425a81
+	jas_image_cmpt_t *cmpt0;
425a81
+
425a81
+	cmpt0 = image->cmpts_[0];
425a81
+	for (cmptno = 1; cmptno < image->numcmpts_; ++cmptno) {
425a81
+		cmpt = image->cmpts_[cmptno];
425a81
+		if (cmpt->tlx_ != cmpt0->tlx_ || cmpt->tly_ != cmpt0->tly_ ||
425a81
+		  cmpt->hstep_ != cmpt0->hstep_ || cmpt->vstep_ != cmpt0->vstep_ ||
425a81
+		  cmpt->width_ != cmpt0->width_ || cmpt->height_ != cmpt0->height_) {
425a81
+			return 0;
425a81
+		}
425a81
+	}
425a81
+	return 1;
425a81
+}
425a81
+
425a81
 static int jpc_dec_tiledecode(jpc_dec_t *dec, jpc_dec_tile_t *tile)
425a81
 {
425a81
 	int i;
425a81
@@ -1074,6 +1092,10 @@ static int jpc_dec_tiledecode(jpc_dec_t
425a81
 			jas_eprintf("RCT requires at least three components\n");
425a81
 			return -1;
425a81
 		}
425a81
+		if (!jas_image_cmpt_domains_same(dec->image)) {
425a81
+			jas_eprintf("RCT requires all components have the same domain\n");
425a81
+			return -1;
425a81
+		}
425a81
 		jpc_irct(tile->tcomps[0].data, tile->tcomps[1].data,
425a81
 		  tile->tcomps[2].data);
425a81
 		break;
425a81
@@ -1082,6 +1104,10 @@ static int jpc_dec_tiledecode(jpc_dec_t
425a81
 			jas_eprintf("ICT requires at least three components\n");
425a81
 			return -1;
425a81
 		}
425a81
+		if (!jas_image_cmpt_domains_same(dec->image)) {
425a81
+			jas_eprintf("RCT requires all components have the same domain\n");
425a81
+			return -1;
425a81
+		}
425a81
 		jpc_iict(tile->tcomps[0].data, tile->tcomps[1].data,
425a81
 		  tile->tcomps[2].data);
425a81
 		break;