diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2022-02-10 14:30:13 +0100 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2022-02-10 14:30:13 +0100 |
| commit | 1462e9403fb7d1186e999701dfe72980262a089c (patch) | |
| tree | affaf5725a068e647e3ed8af1a46db6fbbb78fab /src/lib | |
| parent | 883c31dbe09771aab043744ac2b490d7386878e3 (diff) | |
Avoid integer overflows in DWT. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44544
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/dwt.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/lib/openjp2/dwt.c b/src/lib/openjp2/dwt.c index 2b9b9e92..abc500ec 100644 --- a/src/lib/openjp2/dwt.c +++ b/src/lib/openjp2/dwt.c @@ -801,7 +801,8 @@ static void opj_idwt3_v_cas0(OPJ_INT32* tmp, opj_int_add_no_overflow(opj_int_add_no_overflow(d1c, d1n), 2) >> 2); tmp[i ] = s0c; - tmp[i + 1] = d1c + ((s0c + s0n) >> 1); + tmp[i + 1] = opj_int_add_no_overflow(d1c, opj_int_add_no_overflow(s0c, + s0n) >> 1); } tmp[i] = s0n; |