From 24ddcfc7e37c0ce3b0f1852042ee431a53fd774c Mon Sep 17 00:00:00 2001

From: Robin Watts <Robin.Watts@artifex.com>

Date: Mon, 27 Jan 2020 10:12:24 -0800

Subject: [PATCH] Fix OSS-Fuzz issue 20332: buffer overflow in

 jbig2_image_compose.

With extreme values of x/y/w/h we can get overflow. Test for this

and exit safely.

Thanks for OSS-Fuzz for reporting.

---

 jbig2_image.c | 13 +++++++++++++

 1 file changed, 13 insertions(+)

diff --git a/jbig2_image.c b/jbig2_image.c

index 22e21ef..f036cef 100644

--- a/jbig2_image.c

+++ b/jbig2_image.c

@@ -34,6 +34,10 @@

 #define INT32_MAX  0x7fffffff

 #endif

+#if !defined (UINT32_MAX)

+#define UINT32_MAX  0xffffffffu

+#endif

+

 /* allocate a Jbig2Image structure and its associated bitmap */

 Jbig2Image *

 jbig2_image_new(Jbig2Ctx *ctx, uint32_t width, uint32_t height)

@@ -255,6 +259,15 @@ jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src, int x, int

     uint8_t *d, *dd;

     uint8_t mask, rightmask;

+    if ((UINT32_MAX - src->width  < (x > 0 ? x : -x)) ||

+        (UINT32_MAX - src->height < (y > 0 ? y : -y)))

+    {

+#ifdef JBIG2_DEBUG

+        jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, -1, "overflow in compose_image");

+#endif

+        return 0;

+    }

+

     if (src == NULL)

         return 0;

-- 

2.26.2