diff options
| author | Even Rouault <even.rouault@spatialys.com> | 2017-07-29 17:28:55 +0200 |
|---|---|---|
| committer | Even Rouault <even.rouault@spatialys.com> | 2017-07-29 17:28:55 +0200 |
| commit | 2fa0fc61f2d546c8b67e7c5a9cbc61d98e1f7af0 (patch) | |
| tree | a65ebcf415445ad34520f01eac391a0a7e150ae8 /src | |
| parent | db9ef99f6dd054a84fa8382c02869fb0656abfc8 (diff) | |
imagetopnm(): make sure the alpha component has same dimension as other components to avoid read heap buffer overflow (#970)
Diffstat (limited to 'src')
| -rw-r--r-- | src/bin/jp2/convert.c | 25 |
1 files changed, 16 insertions, 9 deletions
diff --git a/src/bin/jp2/convert.c b/src/bin/jp2/convert.c index a540128f..730ab909 100644 --- a/src/bin/jp2/convert.c +++ b/src/bin/jp2/convert.c @@ -1890,6 +1890,21 @@ opj_image_t* pnmtoimage(const char *filename, opj_cparameters_t *parameters) return image; }/* pnmtoimage() */ +static int are_comps_similar(opj_image_t * image) +{ + unsigned int i; + for (i = 1; i < image->numcomps; i++) { + if (image->comps[0].dx != image->comps[i].dx || + image->comps[0].dy != image->comps[i].dy || + image->comps[0].prec != image->comps[i].prec || + image->comps[0].sgnd != image->comps[i].sgnd) { + return OPJ_FALSE; + } + } + return OPJ_TRUE; +} + + int imagetopnm(opj_image_t * image, const char *outfile, int force_split) { int *red, *green, *blue, *alpha; @@ -1926,15 +1941,7 @@ int imagetopnm(opj_image_t * image, const char *outfile, int force_split) } if ((force_split == 0) && - (ncomp == 2 /* GRAYA */ - || (ncomp > 2 /* RGB, RGBA */ - && image->comps[0].dx == image->comps[1].dx - && image->comps[1].dx == image->comps[2].dx - && image->comps[0].dy == image->comps[1].dy - && image->comps[1].dy == image->comps[2].dy - && image->comps[0].prec == image->comps[1].prec - && image->comps[1].prec == image->comps[2].prec - ))) { + are_comps_similar(image)) { fdest = fopen(outfile, "wb"); if (!fdest) { |