diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2017-07-26 18:05:56 +0200 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2017-07-26 18:05:56 +0200 |
| commit | 5c5319984b81e2aa32d1d83abdef0cdb8dbe7b18 (patch) | |
| tree | 6c0f8c780f7dc487cfc5fb4dba35b660b7ffd0a8 /src/lib | |
| parent | 80818c39f5bfbac37768fcee95b0ffeceaa77264 (diff) | |
Avoid division by zero in opj_pi_next_rpcl, opj_pi_next_pcrl, opj_pi_next_cprl (#938)
Fixes crash on id_000004,sig_06,src_000679,op_arith8,pos_49,val_-17
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/pi.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c index 1aae9d03..84c905fa 100644 --- a/src/lib/openjp2/pi.c +++ b/src/lib/openjp2/pi.c @@ -383,6 +383,13 @@ static OPJ_BOOL opj_pi_next_rpcl(opj_pi_iterator_t * pi) } res = &comp->resolutions[pi->resno]; levelno = comp->numresolutions - 1 - pi->resno; + /* Avoids division by zero */ + /* Relates to id_000004,sig_06,src_000679,op_arith8,pos_49,val_-17 */ + /* of https://github.com/uclouvain/openjpeg/issues/938 */ + if (((comp->dx << levelno) >> levelno) != comp->dx || + ((comp->dy << levelno) >> levelno) != comp->dy) { + continue; + } trx0 = opj_int_ceildiv(pi->tx0, (OPJ_INT32)(comp->dx << levelno)); try0 = opj_int_ceildiv(pi->ty0, (OPJ_INT32)(comp->dy << levelno)); trx1 = opj_int_ceildiv(pi->tx1, (OPJ_INT32)(comp->dx << levelno)); @@ -493,6 +500,13 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_iterator_t * pi) OPJ_INT32 prci, prcj; res = &comp->resolutions[pi->resno]; levelno = comp->numresolutions - 1 - pi->resno; + /* Avoids division by zero */ + /* Relates to id_000004,sig_06,src_000679,op_arith8,pos_49,val_-17 */ + /* of https://github.com/uclouvain/openjpeg/issues/938 */ + if (((comp->dx << levelno) >> levelno) != comp->dx || + ((comp->dy << levelno) >> levelno) != comp->dy) { + continue; + } trx0 = opj_int_ceildiv(pi->tx0, (OPJ_INT32)(comp->dx << levelno)); try0 = opj_int_ceildiv(pi->ty0, (OPJ_INT32)(comp->dy << levelno)); trx1 = opj_int_ceildiv(pi->tx1, (OPJ_INT32)(comp->dx << levelno)); @@ -601,6 +615,12 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_iterator_t * pi) OPJ_INT32 prci, prcj; res = &comp->resolutions[pi->resno]; levelno = comp->numresolutions - 1 - pi->resno; + /* Avoids division by zero on id_000004,sig_06,src_000679,op_arith8,pos_49,val_-17 */ + /* of https://github.com/uclouvain/openjpeg/issues/938 */ + if (((comp->dx << levelno) >> levelno) != comp->dx || + ((comp->dy << levelno) >> levelno) != comp->dy) { + continue; + } trx0 = opj_int_ceildiv(pi->tx0, (OPJ_INT32)(comp->dx << levelno)); try0 = opj_int_ceildiv(pi->ty0, (OPJ_INT32)(comp->dy << levelno)); trx1 = opj_int_ceildiv(pi->tx1, (OPJ_INT32)(comp->dx << levelno)); |