Blame SOURCES/openjpeg2-CVE-2021-3575.patch
|
 |
0591ff |
From 409907d89878222cf9dea80f0add8f73e9383834 Mon Sep 17 00:00:00 2001
|
|
|
0591ff |
From: Mehdi Sabwat <mehdisabwat@gmail.com>
|
|
|
0591ff |
Date: Fri, 7 May 2021 01:50:37 +0200
|
|
|
0591ff |
Subject: [PATCH] fix heap buffer overflow #1347
|
|
|
0591ff |
|
|
|
0591ff |
---
|
|
|
0591ff |
src/bin/common/color.c | 9 ++++++---
|
|
|
0591ff |
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
|
0591ff |
|
|
|
0591ff |
diff --git a/src/bin/common/color.c b/src/bin/common/color.c
|
|
|
0591ff |
index 27f15f1..935fa44 100644
|
|
|
0591ff |
--- a/src/bin/common/color.c
|
|
|
0591ff |
+++ b/src/bin/common/color.c
|
|
|
0591ff |
@@ -368,12 +368,15 @@ static void sycc420_to_rgb(opj_image_t *img)
|
|
|
0591ff |
|
|
|
0591ff |
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
|
|
|
0591ff |
|
|
|
0591ff |
- ++y;
|
|
|
0591ff |
+ if (*y != img->comps[0].data[loopmaxh])
|
|
|
0591ff |
+ ++y;
|
|
|
0591ff |
++r;
|
|
|
0591ff |
++g;
|
|
|
0591ff |
++b;
|
|
|
0591ff |
- ++cb;
|
|
|
0591ff |
- ++cr;
|
|
|
0591ff |
+ if (*cb != img->comps[1].data[loopmaxh])
|
|
|
0591ff |
+ ++cb;
|
|
|
0591ff |
+ if (*cr != img->comps[2].data[loopmaxh])
|
|
|
0591ff |
+ ++cr;
|
|
|
0591ff |
}
|
|
|
0591ff |
if (j < maxw) {
|
|
|
0591ff |
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
|
|
|
0591ff |
--
|
|
|
0591ff |
2.31.1
|
|
|
0591ff |
|