diff options
| author | Antonin Descampe <antonin@gmail.com> | 2014-10-06 21:05:32 +0000 |
|---|---|---|
| committer | Antonin Descampe <antonin@gmail.com> | 2014-10-06 21:05:32 +0000 |
| commit | eb7c6d295aa77279b06d91c84b359f739a9e25bd (patch) | |
| tree | 1eb91bce4fc1969217615e32fb9f4ec93319addb /src/lib/openjp2/t2.c | |
| parent | f126eb0d41f475ed80190c94a071f59839b9a205 (diff) | |
[trunk] fixed potential negative size params (fixes issue 390)
Diffstat (limited to 'src/lib/openjp2/t2.c')
| -rw-r--r-- | src/lib/openjp2/t2.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/lib/openjp2/t2.c b/src/lib/openjp2/t2.c index cdd35e8c..358e815b 100644 --- a/src/lib/openjp2/t2.c +++ b/src/lib/openjp2/t2.c @@ -1265,7 +1265,8 @@ OPJ_BOOL opj_t2_skip_packet_data( opj_t2_t* p_t2, } do { - if (* p_data_read + l_seg->newlen > p_max_length) { + /* Check possible overflow then size */ + if (((*p_data_read + l_seg->newlen) < (*p_data_read)) || ((*p_data_read + l_seg->newlen) > p_max_length)) { fprintf(stderr, "skip: segment too long (%d) with max (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n", l_seg->newlen, p_max_length, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno); return OPJ_FALSE; |