2e1d9e
From 89a5367d49b2556a2635dbb6d48d6a6b182a2c6c Mon Sep 17 00:00:00 2001
2e1d9e
From: Albert Astals Cid <aacid@kde.org>
2e1d9e
Date: Thu, 23 May 2019 00:54:29 +0200
2e1d9e
Subject: [PATCH] JPEG2000Stream: fail gracefully if not all components have
2e1d9e
 the same WxH
2e1d9e
2e1d9e
I think this is just a mistake, or at least the only file we have with
2e1d9e
this scenario is a fuzzed one
2e1d9e
---
2e1d9e
 poppler/JPEG2000Stream.cc | 8 +++++++-
2e1d9e
 1 file changed, 7 insertions(+), 1 deletion(-)
2e1d9e
2e1d9e
diff --git a/poppler/JPEG2000Stream.cc b/poppler/JPEG2000Stream.cc
2e1d9e
index 15bbcae4..0eea3a2d 100644
2e1d9e
--- a/poppler/JPEG2000Stream.cc
2e1d9e
+++ b/poppler/JPEG2000Stream.cc
2e1d9e
@@ -4,7 +4,7 @@
2e1d9e
 //
2e1d9e
 // A JPX stream decoder using OpenJPEG
2e1d9e
 //
2e1d9e
-// Copyright 2008-2010, 2012, 2017, 2018 Albert Astals Cid <aacid@kde.org>
2e1d9e
+// Copyright 2008-2010, 2012, 2017-2019 Albert Astals Cid <aacid@kde.org>
2e1d9e
 // Copyright 2011 Daniel Glöckner <daniel-gl@gmx.net>
2e1d9e
 // Copyright 2014, 2016 Thomas Freitag <Thomas.Freitag@alfa.de>
2e1d9e
 // Copyright 2013, 2014 Adrian Johnson <ajohnson@redneon.com>
2e1d9e
@@ -253,6 +253,12 @@ void JPXStream::init()
2e1d9e
         close();
2e1d9e
         break;
2e1d9e
       }
2e1d9e
+      const int componentPixels = priv->image->comps[component].w * priv->image->comps[component].h;
2e1d9e
+      if (componentPixels != priv->npixels) {
2e1d9e
+        error(errSyntaxWarning, -1, "Component {0:d} has different WxH than component 0", component);
2e1d9e
+        close();
2e1d9e
+        break;
2e1d9e
+      }
2e1d9e
       unsigned char *cdata = (unsigned char *)priv->image->comps[component].data;
2e1d9e
       int adjust = 0;
2e1d9e
       int depth = priv->image->comps[component].prec;
2e1d9e
-- 
2e1d9e
2.21.0
2e1d9e