diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2023-12-08 16:47:34 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-08 16:47:34 +0100 |
| commit | 49c4ef56129b85cce8aaad85e9f22f0f3bc16f2e (patch) | |
| tree | e71bc5736ffb8fcd45545d3aa916a39af6eb0ac0 /src/lib | |
| parent | 00e0bdc14f3feed681de19d46abb2cd8155f3f66 (diff) | |
| parent | a817136f7edbd0e9d9ce46d1faf15506ed9478a0 (diff) | |
Merge pull request #1490 from headshog/fix-j2k
Integer Overflow at j2k.c:3962
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/j2k.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c index cf21c74f..c0551870 100644 --- a/src/lib/openjp2/j2k.c +++ b/src/lib/openjp2/j2k.c @@ -3959,9 +3959,12 @@ static OPJ_BOOL opj_j2k_merge_ppm(opj_cp_t *p_cp, opj_event_mgr_t * p_manager) opj_read_bytes(l_data, &l_N_ppm, 4); l_data += 4; l_data_size -= 4; - l_ppm_data_size += - l_N_ppm; /* can't overflow, max 256 markers of max 65536 bytes, that is when PPM markers are not corrupted which is checked elsewhere */ + if (l_ppm_data_size > UINT_MAX - l_N_ppm) { + opj_event_msg(p_manager, EVT_ERROR, "Too large value for Nppm\n"); + return OPJ_FALSE; + } + l_ppm_data_size += l_N_ppm; if (l_data_size >= l_N_ppm) { l_data_size -= l_N_ppm; l_data += l_N_ppm; |