diff options
| author | Young_X <YangX92@hotmail.com> | 2018-11-23 16:12:53 +0800 |
|---|---|---|
| committer | Young Xiao <YangX92@hotmail.com> | 2018-11-28 14:39:14 +0800 |
| commit | c277159986c80142180fbe5efb256bbf3bdf3edc (patch) | |
| tree | 396e3555762a3f75927ea94166a57c128eb62616 /src/lib | |
| parent | 46822d0eddc3324b2a056bc60ffa997027bebd66 (diff) | |
[MJ2] Avoid index out of bounds access to pi->include[]
Signed-off-by: Young_X <YangX92@hotmail.com>
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openmj2/pi.c | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/src/lib/openmj2/pi.c b/src/lib/openmj2/pi.c index ce9c16e4..f74dc6af 100644 --- a/src/lib/openmj2/pi.c +++ b/src/lib/openmj2/pi.c @@ -85,6 +85,12 @@ static opj_bool pi_next_cprl(opj_pi_iterator_t * pi); ========================================================== */ +static void opj_pi_emit_error(opj_pi_iterator_t * pi, const char* msg) +{ + (void)pi; + (void)msg; +} + static opj_bool pi_next_lrcp(opj_pi_iterator_t * pi) { opj_pi_comp_t *comp = NULL; @@ -114,6 +120,11 @@ static opj_bool pi_next_lrcp(opj_pi_iterator_t * pi) for (pi->precno = pi->poc.precno0; pi->precno < pi->poc.precno1; pi->precno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; + /* Avoids index out of bounds access with include*/ + if (index >= pi->include_size) { + opj_pi_emit_error(pi, "Invalid access to pi->include"); + return OPJ_FALSE; + } if (!pi->include[index]) { pi->include[index] = 1; return OPJ_TRUE; @@ -156,6 +167,11 @@ static opj_bool pi_next_rlcp(opj_pi_iterator_t * pi) for (pi->precno = pi->poc.precno0; pi->precno < pi->poc.precno1; pi->precno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; + /* Avoids index out of bounds access with include*/ + if (index >= pi->include_size) { + opj_pi_emit_error(pi, "Invalid access to pi->include"); + return OPJ_FALSE; + } if (!pi->include[index]) { pi->include[index] = 1; return OPJ_TRUE; @@ -256,6 +272,11 @@ static opj_bool pi_next_rpcl(opj_pi_iterator_t * pi) for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; + /* Avoids index out of bounds access with include*/ + if (index >= pi->include_size) { + opj_pi_emit_error(pi, "Invalid access to pi->include"); + return OPJ_FALSE; + } if (!pi->include[index]) { pi->include[index] = 1; return OPJ_TRUE; @@ -356,6 +377,11 @@ static opj_bool pi_next_pcrl(opj_pi_iterator_t * pi) for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; + /* Avoids index out of bounds access with include*/ + if (index >= pi->include_size) { + opj_pi_emit_error(pi, "Invalid access to pi->include"); + return OPJ_FALSE; + } if (!pi->include[index]) { pi->include[index] = 1; return OPJ_TRUE; @@ -454,6 +480,11 @@ static opj_bool pi_next_cprl(opj_pi_iterator_t * pi) for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; + /* Avoids index out of bounds access with include*/ + if (index >= pi->include_size) { + opj_pi_emit_error(pi, "Invalid access to pi->include"); + return OPJ_FALSE; + } if (!pi->include[index]) { pi->include[index] = 1; return OPJ_TRUE; |