diff options
| author | trylab <trylab@users.noreply.github.com> | 2016-09-06 13:55:49 +0800 |
|---|---|---|
| committer | Mathieu Malaterre <mathieu.malaterre@gmail.com> | 2016-09-13 11:00:08 +0200 |
| commit | 5196bda0b99b5daca18a2c12a83dea047e062fc4 (patch) | |
| tree | 970df17dc9559ace28bebc5986346cd6468d1cc0 /src/lib | |
| parent | 3547402709f1acf2c20a4e818f7aa6dac6bae471 (diff) | |
Fix an integer overflow issue (#809)
Prevent an integer overflow issue in function opj_pi_create_decode of
pi.c.
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/pi.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c index cffad668..36e2ff0c 100644 --- a/src/lib/openjp2/pi.c +++ b/src/lib/openjp2/pi.c @@ -1237,7 +1237,13 @@ opj_pi_iterator_t *opj_pi_create_decode(opj_image_t *p_image, l_current_pi = l_pi; /* memory allocation for include */ - l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16)); + /* prevent an integer overflow issue */ + l_current_pi->include = 00; + if (l_step_l <= (SIZE_MAX / (l_tcp->numlayers + 1U))) + { + l_current_pi->include = (OPJ_INT16*) opj_calloc((l_tcp->numlayers +1) * l_step_l, sizeof(OPJ_INT16)); + } + if (!l_current_pi->include) { |