diff options
| author | Mickael Savinaud <savmickael@users.noreply.github.com> | 2011-10-12 14:44:46 +0000 |
|---|---|---|
| committer | Mickael Savinaud <savmickael@users.noreply.github.com> | 2011-10-12 14:44:46 +0000 |
| commit | 2d39e5d7a59435e8082ed7620420507a68dd3800 (patch) | |
| tree | 2664c30581f6c110c598e5edfcc462558da0bfa6 /libopenjpeg | |
| parent | 27e255fa75b7b9e989de3ec379c9de2b7462983b (diff) | |
[trunk] WIP: resolve heap corruption with p0_07.j2k (credit to Winfried)
Diffstat (limited to 'libopenjpeg')
| -rw-r--r-- | libopenjpeg/pi.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libopenjpeg/pi.c b/libopenjpeg/pi.c index 890800ad..f601c769 100644 --- a/libopenjpeg/pi.c +++ b/libopenjpeg/pi.c @@ -680,7 +680,7 @@ opj_pi_iterator_t *pi_create_decode_v2( opj_image_t *p_image, l_current_pi = l_pi; // memory allocation for include - l_current_pi->include = (OPJ_INT16*) opj_calloc(l_tcp->numlayers * l_step_l, sizeof(OPJ_INT16)); + l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16)); if (!l_current_pi->include) { @@ -689,7 +689,7 @@ opj_pi_iterator_t *pi_create_decode_v2( opj_image_t *p_image, pi_destroy_v2(l_pi, l_bound); return 00; } - memset(l_current_pi->include,0,l_tcp->numlayers * l_step_l* sizeof(OPJ_INT16)); + memset(l_current_pi->include,0, (l_tcp->numlayers + 1) * l_step_l* sizeof(OPJ_INT16)); // special treatment for the first packet iterator l_current_comp = l_current_pi->comps; |