Backport of upstream commits:
From aa0b0f79ade5eef8b0e7a214c03f5af54b36ba7d Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Sat, 26 Nov 2016 17:14:09 -0800
Subject: [PATCH] Fixed numerous integer overflow problems in the code for
packet iterators in the JPC decoder.
From f25486c3d4aa472fec79150f2c41ed4333395d3d Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Sat, 26 Nov 2016 20:54:24 -0800
Subject: [PATCH] Fixed a bug in the packet iterator code. Added a new
regression test case.
From 99a50593254d1b53002719bbecfc946c84b23d27 Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Fri, 9 Dec 2016 05:42:39 -0800
Subject: [PATCH] Apply a patch for the following bug report:
https://github.com/mdadams/jasper/issues/103 Heap-Buffer-Overflow or
Null-pointer-dereference vulnerability due to a programming mistake
(off-by-1)
diff -pruN jasper-1.900.1.orig/src/libjasper/include/jasper/jas_types.h jasper-1.900.1/src/libjasper/include/jasper/jas_types.h
--- jasper-1.900.1.orig/src/libjasper/include/jasper/jas_types.h 2007-01-19 22:43:04.000000000 +0100
+++ jasper-1.900.1/src/libjasper/include/jasper/jas_types.h 2017-03-30 22:12:18.000000000 +0200
@@ -217,6 +217,10 @@ typedef ulonglong uint_fast64_t;
#define JAS_CAST(t, e) \
((t) (e))
+/* The number of bits in the integeral type uint_fast32_t. */
+/* NOTE: This could underestimate the size on some exotic architectures. */
+#define JAS_UINTFAST32_NUMBITS (8 * sizeof(uint_fast32_t))
+
#ifdef __cplusplus
extern "C" {
#endif
diff -pruN jasper-1.900.1.orig/src/libjasper/jpc/jpc_t2cod.c jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_t2cod.c 2017-03-30 18:03:55.000000000 +0200
+++ jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c 2017-03-30 22:14:39.000000000 +0200
@@ -249,10 +249,17 @@ static int jpc_pi_nextrpcl(register jpc_
++compno, ++picomp) {
for (rlvlno = 0, pirlvl = picomp->pirlvls; rlvlno <
picomp->numrlvls; ++rlvlno, ++pirlvl) {
- xstep = picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
- picomp->numrlvls - rlvlno - 1));
- ystep = picomp->vsamp * (1 << (pirlvl->prcheightexpn +
- picomp->numrlvls - rlvlno - 1));
+ // Check for the potential for overflow problems.
+ if (pirlvl->prcwidthexpn + picomp->numrlvls >
+ JAS_UINTFAST32_NUMBITS - 2 ||
+ pirlvl->prcheightexpn + picomp->numrlvls >
+ JAS_UINTFAST32_NUMBITS - 2) {
+ return -1;
+ }
+ xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
+ (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
+ ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
+ (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
pi->xstep = (!pi->xstep) ? xstep : JAS_MIN(pi->xstep, xstep);
pi->ystep = (!pi->ystep) ? ystep : JAS_MIN(pi->ystep, ystep);
}
@@ -282,21 +289,24 @@ static int jpc_pi_nextrpcl(register jpc_
rpy = r + pi->pirlvl->prcheightexpn;
trx0 = JPC_CEILDIV(pi->xstart, pi->picomp->hsamp << r);
try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
- if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx)))
- || !(pi->x % (1 << rpx))) &&
- ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy)))
- || !(pi->y % (1 << rpy)))) {
- prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
- << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
- pi->pirlvl->prcwidthexpn);
- prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
- << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
- pi->pirlvl->prcheightexpn);
+ if (((pi->x == pi->xstart &&
+ ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx)))
+ || !(pi->x % (JAS_CAST(uint_fast32_t, 1) << rpx))) &&
+ ((pi->y == pi->ystart &&
+ ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy)))
+ || !(pi->y % (JAS_CAST(uint_fast32_t, 1) << rpy)))) {
+ prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+ pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+ JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+ prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+ pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+ JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
assert(pi->prcno < pi->pirlvl->numprcs);
for (pi->lyrno = 0; pi->lyrno <
- pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+ pi->numlyrs && pi->lyrno < JAS_CAST(int,
+ pchg->lyrnoend); ++pi->lyrno) {
prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
if (pi->lyrno >= *prclyrno) {
++(*prclyrno);
@@ -341,16 +351,19 @@ static int jpc_pi_nextpcrl(register jpc_
++compno, ++picomp) {
for (rlvlno = 0, pirlvl = picomp->pirlvls; rlvlno <
picomp->numrlvls; ++rlvlno, ++pirlvl) {
- xstep = picomp->hsamp * (1 <<
- (pirlvl->prcwidthexpn + picomp->numrlvls -
- rlvlno - 1));
- ystep = picomp->vsamp * (1 <<
- (pirlvl->prcheightexpn + picomp->numrlvls -
- rlvlno - 1));
- pi->xstep = (!pi->xstep) ? xstep :
- JAS_MIN(pi->xstep, xstep);
- pi->ystep = (!pi->ystep) ? ystep :
- JAS_MIN(pi->ystep, ystep);
+ // Check for the potential for overflow problems.
+ if (pirlvl->prcwidthexpn + picomp->numrlvls >
+ JAS_UINTFAST32_NUMBITS - 2 ||
+ pirlvl->prcheightexpn + picomp->numrlvls >
+ JAS_UINTFAST32_NUMBITS - 2) {
+ return -1;
+ }
+ xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
+ (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
+ ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
+ (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
+ pi->xstep = (!pi->xstep) ? xstep : JAS_MIN(pi->xstep, xstep);
+ pi->ystep = (!pi->ystep) ? ystep : JAS_MIN(pi->ystep, ystep);
}
}
pi->prgvolfirst = 0;
@@ -377,20 +390,23 @@ static int jpc_pi_nextpcrl(register jpc_
try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
rpx = r + pi->pirlvl->prcwidthexpn;
rpy = r + pi->pirlvl->prcheightexpn;
- if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
+ if (((pi->x == pi->xstart &&
+ ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
!(pi->x % (pi->picomp->hsamp << rpx))) &&
- ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
+ ((pi->y == pi->ystart &&
+ ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
!(pi->y % (pi->picomp->vsamp << rpy)))) {
- prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
- << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
- pi->pirlvl->prcwidthexpn);
- prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
- << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
- pi->pirlvl->prcheightexpn);
+ prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+ pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+ JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+ prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+ pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+ JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
assert(pi->prcno < pi->pirlvl->numprcs);
for (pi->lyrno = 0; pi->lyrno < pi->numlyrs &&
- pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+ pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
+ ++pi->lyrno) {
prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
if (pi->lyrno >= *prclyrno) {
++(*prclyrno);
@@ -428,10 +444,17 @@ static int jpc_pi_nextcprl(register jpc_
pi->prgvolfirst = 0;
}
- for (pi->compno = pchg->compnostart, pi->picomp =
- &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
- ++pi->picomp) {
+ for (pi->compno = pchg->compnostart, pi->picomp = &pi->picomps[pi->compno];
+ pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps;
+ ++pi->compno, ++pi->picomp) {
pirlvl = pi->picomp->pirlvls;
+ // Check for the potential for overflow problems.
+ if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
+ JAS_UINTFAST32_NUMBITS - 2 ||
+ pirlvl->prcheightexpn + pi->picomp->numrlvls >
+ JAS_UINTFAST32_NUMBITS - 2) {
+ return -1;
+ }
pi->xstep = pi->picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
(pirlvl->prcwidthexpn + pi->picomp->numrlvls - 1));
pi->ystep = pi->picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
@@ -461,23 +484,23 @@ static int jpc_pi_nextcprl(register jpc_
try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
rpx = r + pi->pirlvl->prcwidthexpn;
rpy = r + pi->pirlvl->prcheightexpn;
- if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
+ if (((pi->x == pi->xstart &&
+ ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
!(pi->x % (pi->picomp->hsamp << rpx))) &&
- ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
+ ((pi->y == pi->ystart &&
+ ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
!(pi->y % (pi->picomp->vsamp << rpy)))) {
- prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
- << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
- pi->pirlvl->prcwidthexpn);
- prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
- << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
- pi->pirlvl->prcheightexpn);
- pi->prcno = prcvind *
- pi->pirlvl->numhprcs +
- prchind;
- assert(pi->prcno <
- pi->pirlvl->numprcs);
- for (pi->lyrno = 0; pi->lyrno <
- pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+ prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+ pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+ JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+ prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+ pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+ JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
+ pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
+ assert(pi->prcno < pi->pirlvl->numprcs);
+ for (pi->lyrno = 0; pi->lyrno < pi->numlyrs &&
+ pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
+ ++pi->lyrno) {
prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
if (pi->lyrno >= *prclyrno) {
++(*prclyrno);