diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2017-07-28 22:06:26 +0200 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2017-07-28 22:06:26 +0200 |
| commit | 361c4506fdfb9b6f0e41d86d5d0ea1efb5704ecf (patch) | |
| tree | 3ec0a35f3d9efab65a1bdbd445d03d5134a5a6c5 /src/lib | |
| parent | 7bdbe490cba9990916f94a40379cc787434340ff (diff) | |
opj_tcd_dc_level_shift_decode(): avoid int overflow. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2516. Credit to OSS Fuzz
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/tcd.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/lib/openjp2/tcd.c b/src/lib/openjp2/tcd.c index a6921464..4d53e8b5 100644 --- a/src/lib/openjp2/tcd.c +++ b/src/lib/openjp2/tcd.c @@ -1890,8 +1890,15 @@ static OPJ_BOOL opj_tcd_dc_level_shift_decode(opj_tcd_t *p_tcd) for (j = 0; j < l_height; ++j) { for (i = 0; i < l_width; ++i) { OPJ_FLOAT32 l_value = *((OPJ_FLOAT32 *) l_current_ptr); - *l_current_ptr = opj_int_clamp((OPJ_INT32)opj_lrintf(l_value) + - l_tccp->m_dc_level_shift, l_min, l_max); ; + OPJ_INT32 l_value_int = (OPJ_INT32)opj_lrintf(l_value); + if (l_value > INT_MAX || + (l_value_int > 0 && l_tccp->m_dc_level_shift > 0 && + l_value_int > INT_MAX - l_tccp->m_dc_level_shift)) { + *l_current_ptr = l_max; + } else { + *l_current_ptr = opj_int_clamp( + l_value_int + l_tccp->m_dc_level_shift, l_min, l_max); + } ++l_current_ptr; } l_current_ptr += l_stride; |