diff options
| author | Even Rouault <even.rouault@mines-paris.org> | 2019-03-29 11:52:38 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-03-29 11:52:38 +0100 |
| commit | d6b8aed5612e6be6d3a4053867fbd2ae0cb7c8af (patch) | |
| tree | 7f38fca07f99aa2261fb97d1e0ff1c0b3b5cf06e | |
| parent | 25b815dc460dbf9def7e6b822c8998727094f85a (diff) | |
| parent | a1d32a596a94280178c44a55d7e7f1acd992ed5d (diff) | |
Merge pull request #1187 from rouault/fix_ubsan_in_opj_t1_encode_cblks
opj_t1_encode_cblks: fix UBSAN signed integer overflow
| -rw-r--r-- | src/lib/openjp2/t1.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/lib/openjp2/t1.c b/src/lib/openjp2/t1.c index ec04c682..f6f76711 100644 --- a/src/lib/openjp2/t1.c +++ b/src/lib/openjp2/t1.c @@ -2168,9 +2168,18 @@ OPJ_BOOL opj_t1_encode_cblks(opj_t1_t *t1, t1->data = tiledp; t1->data_stride = tile_w; if (tccp->qmfbid == 1) { + /* Do multiplication on unsigned type, even if the + * underlying type is signed, to avoid potential + * int overflow on large value (the output will be + * incorrect in such situation, but whatever...) + * This assumes complement-to-2 signed integer + * representation + * Fixes https://github.com/uclouvain/openjpeg/issues/1053 + */ + OPJ_UINT32* OPJ_RESTRICT tiledp_u = (OPJ_UINT32*) tiledp; for (j = 0; j < cblk_h; ++j) { for (i = 0; i < cblk_w; ++i) { - tiledp[tileIndex] *= (1 << T1_NMSEDEC_FRACBITS); + tiledp_u[tileIndex] <<= T1_NMSEDEC_FRACBITS; tileIndex++; } tileIndex += tileLineAdvance; |