From d8c2604cd438c41ec72aff52c16ebd8183068020 Mon Sep 17 00:00:00 2001 From: Michael Adams Date: Sat, 15 Oct 2016 12:22:28 -0700 Subject: [PATCH] Added range check on XRsiz and YRsiz fields of SIZ marker segment. --- src/libjasper/jpc/jpc_cs.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/libjasper/jpc/jpc_cs.c b/src/libjasper/jpc/jpc_cs.c index 6da4872..55d34d6 100644 --- a/src/libjasper/jpc/jpc_cs.c +++ b/src/libjasper/jpc/jpc_cs.c @@ -512,6 +512,16 @@ static int jpc_siz_getparms(jpc_ms_t *ms, jpc_cstate_t *cstate, jas_free(siz->comps); return -1; } + if (siz->comps[i].hsamp == 0 || siz->comps[i].hsamp > 255) { + jas_eprintf("invalid XRsiz value %d\n", siz->comps[i].hsamp); + jas_free(siz->comps); + return -1; + } + if (siz->comps[i].vsamp == 0 || siz->comps[i].vsamp > 255) { + jas_eprintf("invalid YRsiz value %d\n", siz->comps[i].vsamp); + jas_free(siz->comps); + return -1; + } siz->comps[i].sgnd = (tmp >> 7) & 1; siz->comps[i].prec = (tmp & 0x7f) + 1; }