diff options
| author | Mathieu Malaterre <mathieu.malaterre@gmail.com> | 2014-02-26 11:21:18 +0000 |
|---|---|---|
| committer | Mathieu Malaterre <mathieu.malaterre@gmail.com> | 2014-02-26 11:21:18 +0000 |
| commit | 533d92aa8e586dfd35cba92f467261ea400871eb (patch) | |
| tree | 30238afb749f4a9b4ddaa717547cafc520828b5a /src/lib | |
| parent | 19887b7b8c4e1cdc54d25a3d10be2415a1385816 (diff) | |
[trunk] Import patch from sumatrapdf team. This handle some testcase with no input dataset, but changes looks ok.
Update issue 225
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/jp2.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/src/lib/openjp2/jp2.c b/src/lib/openjp2/jp2.c index 3678be67..0af1f960 100644 --- a/src/lib/openjp2/jp2.c +++ b/src/lib/openjp2/jp2.c @@ -985,6 +985,11 @@ OPJ_BOOL opj_jp2_read_pclr( opj_jp2_t *jp2, if ((ptrdiff_t)p_pclr_header_size < p_pclr_header_data - orig_header_data + bytes_to_read) return OPJ_FALSE; + if (bytes_to_read > sizeof(OPJ_UINT32)) + bytes_to_read = sizeof(OPJ_UINT32); + if ((ptrdiff_t)p_pclr_header_size < p_pclr_header_data - orig_header_data + bytes_to_read) + return OPJ_FALSE; + opj_read_bytes(p_pclr_header_data, &l_value , bytes_to_read); /* Cji */ p_pclr_header_data += bytes_to_read; *entries = (OPJ_UINT32) l_value; @@ -1031,6 +1036,11 @@ OPJ_BOOL opj_jp2_read_cmap( opj_jp2_t * jp2, return OPJ_FALSE; } + if (p_cmap_header_size < (OPJ_UINT32)nr_channels * 4) { + opj_event_msg(p_manager, EVT_ERROR, "Insufficient data for CMAP box.\n"); + return OPJ_FALSE; + } + cmap = (opj_jp2_cmap_comp_t*) opj_malloc(nr_channels * sizeof(opj_jp2_cmap_comp_t)); if (!cmap) return OPJ_FALSE; @@ -1122,6 +1132,11 @@ OPJ_BOOL opj_jp2_read_cdef( opj_jp2_t * jp2, return OPJ_FALSE; } + if (p_cdef_header_size < 2) { + opj_event_msg(p_manager, EVT_ERROR, "Insufficient data for CDEF box.\n"); + return OPJ_FALSE; + } + opj_read_bytes(p_cdef_header_data,&l_value ,2); /* N */ p_cdef_header_data+= 2; @@ -1135,6 +1150,11 @@ OPJ_BOOL opj_jp2_read_cdef( opj_jp2_t * jp2, return OPJ_FALSE; } + if (p_cdef_header_size < 2 + (OPJ_UINT32)(OPJ_UINT16)l_value * 6) { + opj_event_msg(p_manager, EVT_ERROR, "Insufficient data for CDEF box.\n"); + return OPJ_FALSE; + } + cdef_info = (opj_jp2_cdef_info_t*) opj_malloc(l_value * sizeof(opj_jp2_cdef_info_t)); if (!cdef_info) return OPJ_FALSE; |