diff options
| author | Antonin Descampe <antonin@gmail.com> | 2014-10-03 10:15:28 +0000 |
|---|---|---|
| committer | Antonin Descampe <antonin@gmail.com> | 2014-10-03 10:15:28 +0000 |
| commit | 48832d944f25b6e8f81c44ce2f2b780ab6a53f7c (patch) | |
| tree | 3ea432099d6a63956ac353499b4df44276a0f1ea /src | |
| parent | 06bd61b571aa82f65b8c2b6f2c3330a2e712dcfe (diff) | |
[trunk]fixes buffer overflow in t2.c
Update issue 390
Summary: check for negative-size params in code
Patch from Matthieu applied. Left open to apply this to other places in
code.
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/openjp2/t2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lib/openjp2/t2.c b/src/lib/openjp2/t2.c index f2a7c9a5..cdd35e8c 100644 --- a/src/lib/openjp2/t2.c +++ b/src/lib/openjp2/t2.c @@ -1132,7 +1132,7 @@ OPJ_BOOL opj_t2_read_packet_data( opj_t2_t* p_t2, do { /* Check possible overflow (on l_current_data only, assumes input args already checked) then size */ - if (((OPJ_SIZE_T)(l_current_data + l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) { + if ((((OPJ_SIZE_T)l_current_data + (OPJ_SIZE_T)l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) { fprintf(stderr, "read: segment too long (%d) with max (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n", l_seg->newlen, p_max_length, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno); return OPJ_FALSE; |