diff options
| author | Matthieu Darbois <mayeut@users.noreply.github.com> | 2016-09-08 00:24:15 +0200 |
|---|---|---|
| committer | Mathieu Malaterre <mathieu.malaterre@gmail.com> | 2016-09-13 11:00:08 +0200 |
| commit | b75acb3bb9e0fdf0f167f0a3331470c0a6e5ff3e (patch) | |
| tree | 2a20c4f21793f5b420330b5060eb6830eca947f5 /src/lib | |
| parent | 2978541ea26e8eb0e372492d733d7b930ee0e440 (diff) | |
Add sanity check for tile coordinates (#823)
Coordinates are casted from OPJ_UINT32 to OPJ_INT32
Add sanity check for negative values and upper bound becoming lower
than lower bound.
See also
https://pdfium.googlesource.com/pdfium/+/b6befb2ed2485a3805cddea86dc7574510178ea9
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/tcd.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/lib/openjp2/tcd.c b/src/lib/openjp2/tcd.c index 12da05ca..7a29c491 100644 --- a/src/lib/openjp2/tcd.c +++ b/src/lib/openjp2/tcd.c @@ -696,9 +696,20 @@ static INLINE OPJ_BOOL opj_tcd_init_tile(opj_tcd_t *p_tcd, OPJ_UINT32 p_tile_no, l_tx0 = l_cp->tx0 + p * l_cp->tdx; /* can't be greater than l_image->x1 so won't overflow */ l_tile->x0 = (OPJ_INT32)opj_uint_max(l_tx0, l_image->x0); l_tile->x1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, l_cp->tdx), l_image->x1); + /* all those OPJ_UINT32 are casted to OPJ_INT32, let's do some sanity check */ + if ((l_tile->x0 < 0) || (l_tile->x1 <= l_tile->x0)) { + opj_event_msg(manager, EVT_ERROR, "Tile X coordinates are not supported\n"); + return OPJ_FALSE; + } l_ty0 = l_cp->ty0 + q * l_cp->tdy; /* can't be greater than l_image->y1 so won't overflow */ l_tile->y0 = (OPJ_INT32)opj_uint_max(l_ty0, l_image->y0); l_tile->y1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, l_cp->tdy), l_image->y1); + /* all those OPJ_UINT32 are casted to OPJ_INT32, let's do some sanity check */ + if ((l_tile->y0 < 0) || (l_tile->y1 <= l_tile->y0)) { + opj_event_msg(manager, EVT_ERROR, "Tile Y coordinates are not supported\n"); + return OPJ_FALSE; + } + /* testcase 1888.pdf.asan.35.988 */ if (l_tccp->numresolutions == 0) { |