|
 |
83be9e |
Backport of the upstream commit:
|
|
|
83be9e |
|
|
|
83be9e |
From f7038068550fba0e41e1d0c355787f1dcd5bf330 Mon Sep 17 00:00:00 2001
|
|
|
83be9e |
From: Michael Adams <mdadams@ece.uvic.ca>
|
|
|
83be9e |
Date: Thu, 27 Oct 2016 20:11:57 -0700
|
|
|
83be9e |
Subject: [PATCH] Added some missing sanity checks on the data in a SIZ marker
|
|
|
83be9e |
segment.
|
|
|
83be9e |
|
|
|
83be9e |
diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_cs.c jasper-1.900.1/src/libjasper/jpc/jpc_cs.c
|
|
|
83be9e |
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_cs.c 2017-03-29 22:30:41.000000000 +0200
|
|
|
83be9e |
+++ jasper-1.900.1/src/libjasper/jpc/jpc_cs.c 2017-03-29 22:48:20.267725023 +0200
|
|
|
83be9e |
@@ -483,6 +483,8 @@ static int jpc_siz_getparms(jpc_ms_t *ms
|
|
|
83be9e |
unsigned int i;
|
|
|
83be9e |
uint_fast8_t tmp;
|
|
|
83be9e |
|
|
|
83be9e |
+ siz->comps = 0;
|
|
|
83be9e |
+
|
|
|
83be9e |
/* Eliminate compiler warning about unused variables. */
|
|
|
83be9e |
cstate = 0;
|
|
|
83be9e |
|
|
|
83be9e |
@@ -496,44 +498,67 @@ static int jpc_siz_getparms(jpc_ms_t *ms
|
|
|
83be9e |
jpc_getuint32(in, &siz->tilexoff) ||
|
|
|
83be9e |
jpc_getuint32(in, &siz->tileyoff) ||
|
|
|
83be9e |
jpc_getuint16(in, &siz->numcomps)) {
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
}
|
|
|
83be9e |
- if (!siz->width || !siz->height || !siz->tilewidth ||
|
|
|
83be9e |
- !siz->tileheight || !siz->numcomps) {
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
- }
|
|
|
83be9e |
- if (siz->tilexoff >= siz->width || siz->tileyoff >= siz->height) {
|
|
|
83be9e |
- jas_eprintf("all tiles are outside the image area\n");
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
+ if (!siz->width || !siz->height) {
|
|
|
83be9e |
+ jas_eprintf("reference grid cannot have zero area\n");
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
+ }
|
|
|
83be9e |
+ if (!siz->tilewidth || !siz->tileheight) {
|
|
|
83be9e |
+ jas_eprintf("tile cannot have zero area\n");
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
+ }
|
|
|
83be9e |
+ if (!siz->numcomps || siz->numcomps > 16384) {
|
|
|
83be9e |
+ jas_eprintf("number of components not in permissible range\n");
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
+ }
|
|
|
83be9e |
+ if (siz->xoff >= siz->width) {
|
|
|
83be9e |
+ jas_eprintf("XOsiz not in permissible range\n");
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
+ }
|
|
|
83be9e |
+ if (siz->yoff >= siz->height) {
|
|
|
83be9e |
+ jas_eprintf("YOsiz not in permissible range\n");
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
+ }
|
|
|
83be9e |
+ if (siz->tilexoff > siz->xoff || siz->tilexoff + siz->tilewidth <= siz->xoff) {
|
|
|
83be9e |
+ jas_eprintf("XTOsiz not in permissible range\n");
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
+ }
|
|
|
83be9e |
+ if (siz->tileyoff > siz->yoff || siz->tileyoff + siz->tileheight <= siz->yoff) {
|
|
|
83be9e |
+ jas_eprintf("YTOsiz not in permissible range\n");
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
}
|
|
|
83be9e |
+
|
|
|
83be9e |
if (!(siz->comps = jas_alloc2(siz->numcomps, sizeof(jpc_sizcomp_t)))) {
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
}
|
|
|
83be9e |
for (i = 0; i < siz->numcomps; ++i) {
|
|
|
83be9e |
if (jpc_getuint8(in, &tmp) ||
|
|
|
83be9e |
jpc_getuint8(in, &siz->comps[i].hsamp) ||
|
|
|
83be9e |
jpc_getuint8(in, &siz->comps[i].vsamp)) {
|
|
|
83be9e |
- jas_free(siz->comps);
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
}
|
|
|
83be9e |
if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) {
|
|
|
83be9e |
jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp);
|
|
|
83be9e |
- jas_free(siz->comps);
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
}
|
|
|
83be9e |
if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) {
|
|
|
83be9e |
jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp);
|
|
|
83be9e |
- jas_free(siz->comps);
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
}
|
|
|
83be9e |
siz->comps[i].sgnd = (tmp >> 7) & 1;
|
|
|
83be9e |
siz->comps[i].prec = (tmp & 0x7f) + 1;
|
|
|
83be9e |
}
|
|
|
83be9e |
if (jas_stream_eof(in)) {
|
|
|
83be9e |
- jas_free(siz->comps);
|
|
|
83be9e |
- return -1;
|
|
|
83be9e |
+ goto error;
|
|
|
83be9e |
}
|
|
|
83be9e |
return 0;
|
|
|
83be9e |
+
|
|
|
83be9e |
+error:
|
|
|
83be9e |
+ if (siz->comps) {
|
|
|
83be9e |
+ jas_free(siz->comps);
|
|
|
83be9e |
+ }
|
|
|
83be9e |
+ return -1;
|
|
|
83be9e |
}
|
|
|
83be9e |
|
|
|
83be9e |
static int jpc_siz_putparms(jpc_ms_t *ms, jpc_cstate_t *cstate, jas_stream_t *out)
|