diff options
| author | Even Rouault <even.rouault@mines-paris.org> | 2018-12-21 16:41:00 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-12-21 16:41:00 +0100 |
| commit | 51f097e6d5754ddae93e716276fe8176b44ec548 (patch) | |
| tree | 334e85bf3473e5fd9ac7532ff746bbeaa6bef9f3 /src | |
| parent | e7640f58f122d1228f3d750864543ad4703e18fc (diff) | |
| parent | 8ee335227bbcaf1614124046aa25e53d67b11ec3 (diff) | |
Merge pull request #1172 from hlef/master
convertbmp: detect invalid file dimensions early (CVE-2018-6616)
Diffstat (limited to 'src')
| -rw-r--r-- | src/bin/jp2/convertbmp.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/bin/jp2/convertbmp.c b/src/bin/jp2/convertbmp.c index 85a47fea..0af52f81 100644 --- a/src/bin/jp2/convertbmp.c +++ b/src/bin/jp2/convertbmp.c @@ -534,14 +534,14 @@ static OPJ_BOOL bmp_read_raw_data(FILE* IN, OPJ_UINT8* pData, OPJ_UINT32 stride, static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData, OPJ_UINT32 stride, OPJ_UINT32 width, OPJ_UINT32 height) { - OPJ_UINT32 x, y; + OPJ_UINT32 x, y, written; OPJ_UINT8 *pix; const OPJ_UINT8 *beyond; beyond = pData + stride * height; pix = pData; - x = y = 0U; + x = y = written = 0U; while (y < height) { int c = getc(IN); if (c == EOF) { @@ -561,6 +561,7 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData, for (j = 0; (j < c) && (x < width) && ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) { *pix = c1; + written++; } } else { c = getc(IN); @@ -598,6 +599,7 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData, } c1 = (OPJ_UINT8)c1_int; *pix = c1; + written++; } if ((OPJ_UINT32)c & 1U) { /* skip padding byte */ c = getc(IN); @@ -608,6 +610,12 @@ static OPJ_BOOL bmp_read_rle8_data(FILE* IN, OPJ_UINT8* pData, } } }/* while() */ + + if (written != width * height) { + fprintf(stderr, "warning, image's actual size does not match advertized one\n"); + return OPJ_FALSE; + } + return OPJ_TRUE; } |