summaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2019-03-29opj_t1_encode_cblks: fix UBSAN signed integer overflowEven Rouault
Fixes #1053 / CVE-2018-5727 Note: I don't consider this issue to be a security vulnerability, in practice. At least with gcc or clang compilers on x86_64 which generate the same assembly code with or without that fix.
2019-03-29Revert "[JPWL] tgatoimage(): avoid excessive memory allocation attempt,"Even Rouault
This reverts commit 05be3084460e46282ee63f04c72c451f3271fd28. This commit doesn't compile due to missing OPJ_UINT64 type
2019-03-29Revert "[MJ2] Avoid index out of bounds access to pi->include[]"Even Rouault
This reverts commit c277159986c80142180fbe5efb256bbf3bdf3edc. The commit didn't compile. include_size is not defined in openmj2
2018-12-14convertbmp: detect invalid file dimensions earlyHugo Lefeuvre
width/length dimensions read from bmp headers are not necessarily valid. For instance they may have been maliciously set to very large values with the intention to cause DoS (large memory allocation, stack overflow). In these cases we want to detect the invalid size as early as possible. This commit introduces a counter which verifies that the number of written bytes corresponds to the advertized width/length. Fixes #1059 (CVE-2018-6616).
2018-12-07Merge pull request #1168 from Young-X/fix_devEven Rouault
Fix multiple potential vulnerabilities and bugs
2018-11-28[JPWL] tgatoimage(): avoid excessive memory allocation attempt,Young Xiao
and fixes unaligned load Signed-off-by: Young Xiao <YangX92@hotmail.com>
2018-11-28 [JP3D] To avoid divisions by zero / undefined behaviour on shift ↵Young_X
(CVE-2018-14423 Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-28 [JPWL] opj_compress: reorder checks related to code block dimensions to ↵Young_X
avoid potential int overflow Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-28[OPENJP2] change the way to compute *p_tx0, *p_tx1, *p_ty0, *p_ty1 in functionYoung_X
opj_get_encoding_parameters Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-28[MJ2] Avoid index out of bounds access to pi->include[]Young_X
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-27color_apply_icc_profile: avoid potential heap buffer overflowEven Rouault
Derived from a patch by Thuan Pham
2018-11-23[JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987)Young_X
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-23[JPWL] fix CVE-2018-16375Young_X
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-23[MJ2] To avoid divisions by zero / undefined behaviour on shiftYoung_X
Signed-off-by: Young_X <YangX92@hotmail.com>
2018-11-16Merge pull request #1160 from hlef/masterEven Rouault
jp3d/jpwl convert: fix write stack buffer overflow
2018-11-16openjp3d: Int overflow fixed (#1159)ichlubna
When compressing a lot of slices (starting from 44 FullHD slices with 3 8bit components in our experiments) the rate values are high enough to cause an int overflow that leads to negative lengths and wrong results. The cast happens too late.
2018-11-07jp2: convert: fix null pointer dereferenceHugo Lefeuvre
Tile components in a JP2 image might have null data pointer by defining a zero component size (for example using large horizontal or vertical sampling periods). This null data pointer leads to null image component data pointer, causing crash when dereferenced without != null check in imagetopnm. Add != null check. This commit addresses #1152 (CVE-2018-18088).
2018-11-01jp3d/jpwl convert: fix write stack buffer overflowHugo Lefeuvre
Missing buffer length formatter in fscanf call might lead to write stack buffer overflow. fixes #1044 (CVE-2017-17480)
2018-10-31Fix some potential overflow issues (#1161)Stefan Weil
* Fix some potential overflow issues Put sizeof to the beginning of the multiplication to enforce that size_t instead of smaller integer types is used for the calculation. This fixes warnings from LGTM: Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'. It also allows removing some type casts. Signed-off-by: Stefan Weil <sw@weilnetz.de> * Fix code indentation Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-10-31Fix several memory and resource leaksNikola Forró
Signed-off-by: Nikola Forró <nforro@redhat.com>
2018-10-18opj_thread_pool_setup(): fix infinite waiting if a thread creation failedEven Rouault
2018-09-22Merge pull request #1148 from hlef/masterEven Rouault
CVE-2018-5785: fix issues with zero bitmasks
2018-09-22opj_jp2_apply_pclr(): remove useless assert that can trigger on some files ↵Even Rouault
(fixes #1125)
2018-09-22Merge branch 'pr1095'Even Rouault
2018-09-22opj_mj2_extract: Check provided output prefix for lengthKarol Babioch
This uses snprintf() with correct buffer length instead of sprintf(), which prevents a buffer overflow when providing a long output prefix. Furthermore the program exits with an error when the provided output prefix is too long. Fixes #1088.
2018-09-22Merge branch 'pr1107'Even Rouault
2018-09-22opj_mj2_extract: Avoid segfault for long filenamesszukw000
2018-09-22Merge pull request #1136 from reverson/masterEven Rouault
Cast on uint ceildiv
2018-09-22Merge pull request #1119 from stweil/ssize_tEven Rouault
Use local type declaration for POSIX standard type only for MS compiler
2018-09-22Merge pull request #1128 from stweil/typosEven Rouault
Fix some typos in code comments and documentation
2018-09-22Merge pull request #1141 from szukw000/changes-in-pnmtoimageEven Rouault
Changes in pnmtoimage if image data are missing
2018-09-22convertbmp: fix issues with zero bitmasksHugo Lefeuvre
In the case where a BMP file declares compression 3 (BI_BITFIELDS) with header size <= 56, all bitmask values keep their initialization value 0. This may lead to various undefined behavior later e.g. when doing 1 << (l_comp->prec - 1). This issue does not affect files with bit count 16 because of a check added in 16240e2 which sets default values to the color masks if they are all 0. This commit adds similar checks for the 32 bit case. Also, if a BMP file declares compression 3 with header size >= 56 and intentional 0 bitmasks, the same issue will be triggered in both the 16 and 32 bit count case. This commit adds checks to bmp_read_info_header() rejecting BMP files with "intentional" 0 bitmasks. These checks might be removed in the future when proper handling of zero bitmasks will be available in openjpeg2. fixes #1057 (CVE-2018-5785)
2018-09-05openjp2/jp2: Fix two format stringsStefan Weil
Compiler warnings: src/lib/openjp2/jp2.c:1008:35: warning: too many arguments for format [-Wformat-extra-args] src/lib/openjp2/j2k.c:1928:73: warning: format ‘%d’ expects argument of type ‘int’, but argument 4 has type ‘OPJ_OFF_T {aka long int}’ [-Wformat=] Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-09-05Fix some typos in code comments and documentationStefan Weil
All typos were found by Codespell. Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-08-31Changes in pnmtoimage if image data are missingszukw000
2018-08-27Cast on uint ceildivRobert Everson
2018-06-20Avoid assertion when running opj_j2k_merge_ppt() several time due to ↵Even Rouault
e6674f7ed66abdb32a0be5944f618722b6a7b5d5 revert. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2785
2018-06-20Revert "Avoid assertion in opj_j2k_merge_ppt() in case premature EOC is ↵Even Rouault
encountered in opj_j2k_read_tile_header(). Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2785. Credit to OSS Fuzz" (fixes #1120) This reverts commit 9906fbf737692486cebabe98169988d818e2e66a. which broke decoding of images where TNsot == 0
2018-06-18Use local type declaration for POSIX standard type only for MS compilerStefan Weil
ssize_t is a POSIX type which is declared in POSIX include files. Mingw-w64 provides it also for Windows. Use the local declaration only with MS compilers. Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-06-16opj_compress: try to make help message of -c switch clearer (fixes #1117)Even Rouault
2018-03-12opj_compress: fix help message regarding default precinct sizeEven Rouault
2018-03-04Merge pull request #1094 from kbabioch/fix/missing-format-string-parameterEven Rouault
mj2: Add missing variable to format string in fprintf() invocation in meta_out.c
2018-03-04Merge pull request #1096 from kbabioch/fix/opj_mj2_extract-helpEven Rouault
opj_mj2_extract: Rename output_location to output_prefix
2018-03-03jp3d: Replace sprintf() by snprintf() in volumetobin()Karol Babioch
This replaces the unsafe sprintf() invocation by the safer snprintf() one, with the correct buffer size to prevent buffer overflows. This fixes #1085.
2018-03-02opj_mj2_extract: Rename output_location to output_prefixKarol Babioch
This renames the argument in the help output, as the latter better describes the the purpose of this argument.
2018-03-02mj2: Add missing variable to format string in fprintf() invocation in meta_out.cKarol Babioch
This adds the appropriate variables to the invocation of fprintf(). They were specified in the format string, but were missing in the actual call. This fixes #1074 and #1075.
2018-02-25openjp3d: Convert ISO-8859 to UTF-8Stefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-02-25jp3d: Convert ISO-8859 to UTF-8Stefan Weil
Signed-off-by: Stefan Weil <sw@weilnetz.de>
2018-02-25Merge pull request #1080 from setharnold/patch-1Even Rouault
fix unchecked integer multiplication overflow
2018-02-18bench_dwt: fix wrong index in iteration (issue found by Fethi Migaou)Even Rouault
generated by cgit v1.2.3 (git 2.46.0) at 2026-04-10 05:49:54 +0000