diff options
| author | mayeut <mayeut@users.noreply.github.com> | 2015-09-06 17:24:03 +0200 |
|---|---|---|
| committer | mayeut <mayeut@users.noreply.github.com> | 2015-09-06 17:24:03 +0200 |
| commit | 940100c28ae28931722290794889cf84a92c5f6f (patch) | |
| tree | 208588a4efba3e2bfd146c154a62d9d8a6bfa4a5 /src/lib | |
| parent | c31fb68ccc0e53d70b21fd068b04b2c1ca4d933f (diff) | |
Fix potential use-after-free in opj_j2k_write_mco function
Fixes #563
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/j2k.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c index 19a48f56..d487d89d 100644 --- a/src/lib/openjp2/j2k.c +++ b/src/lib/openjp2/j2k.c @@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, assert(p_stream != 00); l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]); - l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; - + l_mco_size = 5 + l_tcp->m_nb_mcc_records; if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) { @@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data; p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size; } + l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; + opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */ l_current_data += 2; @@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, ++l_current_data; l_mcc_record = l_tcp->m_mcc_records; - for (i=0;i<l_tcp->m_nb_mcc_records;++i) { + for (i=0;i<l_tcp->m_nb_mcc_records;++i) { opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/ ++l_current_data; - ++l_mcc_record; } |