diff options
| author | Matthieu Darbois <mayeut@users.noreply.github.com> | 2014-12-20 13:03:11 +0000 |
|---|---|---|
| committer | Matthieu Darbois <mayeut@users.noreply.github.com> | 2014-12-20 13:03:11 +0000 |
| commit | e966fef3eba04cf008852f89dcf71cd5a2dfcb40 (patch) | |
| tree | 7202d0a3edbcaa99f4dbc0d0ed205cd8b719d4c2 /src/lib | |
| parent | a504edf724f9516e8cc50d3366bf42c9865b05b0 (diff) | |
[trunk] fixed a possible overflow in opj_t1_encode_cblks call to opj_int_fix_mul (fixes issue 141)
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/openjp2/opj_intmath.h | 19 | ||||
| -rw-r--r-- | src/lib/openjp2/t1.c | 4 |
2 files changed, 17 insertions, 6 deletions
diff --git a/src/lib/openjp2/opj_intmath.h b/src/lib/openjp2/opj_intmath.h index f35e40ab..641fcaa2 100644 --- a/src/lib/openjp2/opj_intmath.h +++ b/src/lib/openjp2/opj_intmath.h @@ -108,7 +108,7 @@ Divide an integer and round upwards @return Returns a divided by b */ static INLINE OPJ_INT32 opj_int_ceildiv(OPJ_INT32 a, OPJ_INT32 b) { - assert(b); + assert(b); return (a + b - 1) / b; } @@ -117,6 +117,7 @@ Divide an integer and round upwards @return Returns a divided by b */ static INLINE OPJ_UINT32 opj_uint_ceildiv(OPJ_UINT32 a, OPJ_UINT32 b) { + assert(b); return (a + b - 1) / b; } @@ -165,9 +166,19 @@ Multiply two fixed-precision rational numbers. @return Returns a * b */ static INLINE OPJ_INT32 opj_int_fix_mul(OPJ_INT32 a, OPJ_INT32 b) { - OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ; - temp += 4096; - return (OPJ_INT32) (temp >> 13) ; + OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ; + temp += 4096; + assert((temp >> 13) <= (OPJ_INT64)0x7FFFFFFF); + assert((temp >> 13) >= (-(OPJ_INT64)0x7FFFFFFF - (OPJ_INT64)1)); + return (OPJ_INT32) (temp >> 13); +} + +static INLINE OPJ_INT32 opj_int_fix_mul_t1(OPJ_INT32 a, OPJ_INT32 b) { + OPJ_INT64 temp = (OPJ_INT64) a * (OPJ_INT64) b ; + temp += 4096; + assert((temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) <= (OPJ_INT64)0x7FFFFFFF); + assert((temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) >= (-(OPJ_INT64)0x7FFFFFFF - (OPJ_INT64)1)); + return (OPJ_INT32) (temp >> (13 + 11 - T1_NMSEDEC_FRACBITS)) ; } /* ----------------------------------------------------------------------- */ diff --git a/src/lib/openjp2/t1.c b/src/lib/openjp2/t1.c index e61cd3c9..8cb230f4 100644 --- a/src/lib/openjp2/t1.c +++ b/src/lib/openjp2/t1.c @@ -1534,9 +1534,9 @@ OPJ_BOOL opj_t1_encode_cblks( opj_t1_t *t1, for (i = 0; i < cblk_w; ++i) { OPJ_INT32 tmp = tiledp[tileIndex]; tiledp[tileIndex] = - opj_int_fix_mul( + opj_int_fix_mul_t1( tmp, - bandconst) >> (11 - T1_NMSEDEC_FRACBITS); + bandconst); tileIndex++; } tileIndex += tileLineAdvance; |