Blob Blame History Raw
From 409907d89878222cf9dea80f0add8f73e9383834 Mon Sep 17 00:00:00 2001
From: Mehdi Sabwat <mehdisabwat@gmail.com>
Date: Fri, 7 May 2021 01:50:37 +0200
Subject: [PATCH] fix heap buffer overflow #1347

---
 src/bin/common/color.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/bin/common/color.c b/src/bin/common/color.c
index 27f15f1..935fa44 100644
--- a/src/bin/common/color.c
+++ b/src/bin/common/color.c
@@ -368,12 +368,15 @@ static void sycc420_to_rgb(opj_image_t *img)
 
             sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
 
-            ++y;
+            if (*y != img->comps[0].data[loopmaxh])
+                ++y;
             ++r;
             ++g;
             ++b;
-            ++cb;
-            ++cr;
+            if (*cb != img->comps[1].data[loopmaxh])
+                ++cb;
+            if (*cr != img->comps[2].data[loopmaxh])
+                ++cr;
         }
         if (j < maxw) {
             sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
-- 
2.31.1