opj_read_bytes(p_header_data,&(p_j2k->m_current_tile_number),2); /* Isot */
p_header_data+=2;
+ /* testcase 2.pdf.SIGFPE.706.1112 */
+ if (p_j2k->m_current_tile_number >= l_cp->tw * l_cp->th) {
+ opj_event_msg(p_manager, EVT_ERROR, "Invalid tile number %d\n", p_j2k->m_current_tile_number);
+ return OPJ_FALSE;
+ }
+
l_tcp = &l_cp->tcps[p_j2k->m_current_tile_number];
l_tile_x = p_j2k->m_current_tile_number % l_cp->tw;
l_tile_y = p_j2k->m_current_tile_number / l_cp->tw;
if (l_num_parts != 0) { /* Number of tile-part header is provided by this tile-part header */
/* Useful to manage the case of textGBR.jp2 file because two values of TNSot are allowed: the correct numbers of
* tile-parts for that tile and zero (A.4.2 of 15444-1 : 2002). */
- if (l_tcp->m_nb_tile_parts) {
- if (l_current_part >= l_tcp->m_nb_tile_parts){
- opj_event_msg(p_manager, EVT_ERROR, "In SOT marker, TPSot (%d) is not valid regards to the current "
- "number of tile-part (%d), giving up\n", l_current_part, l_tcp->m_nb_tile_parts );
- p_j2k->m_specific_param.m_decoder.m_last_tile_part = 1;
- return OPJ_FALSE;
- }
+ if (l_num_parts < l_tcp->m_nb_tile_parts) {
+ l_num_parts = l_tcp->m_nb_tile_parts;
+ }
+ if (l_current_part >= l_num_parts) {
+ /* testcase 451.pdf.SIGSEGV.ce9.3723 */
+ l_num_parts = l_current_part + 1;
}
l_tcp->m_nb_tile_parts = l_num_parts;
}
/* If know the number of tile part header we will check if we didn't read the last*/
if (l_tcp->m_nb_tile_parts) {
- if (l_tcp->m_nb_tile_parts == (l_current_part + 1)) {
+ if (l_tcp->m_nb_tile_parts == l_current_part) {
p_j2k->m_specific_param.m_decoder.m_can_decode = 1; /* Process the last tile-part header*/
}
}
if ( l_current_part >= p_j2k->cstr_index->tile_index[p_j2k->m_current_tile_number].current_nb_tps ){
opj_tp_index_t *new_tp_index;
- p_j2k->cstr_index->tile_index[p_j2k->m_current_tile_number].current_nb_tps += 10;
+ p_j2k->cstr_index->tile_index[p_j2k->m_current_tile_number].current_nb_tps = l_current_part + 1;
new_tp_index = (opj_tp_index_t *) opj_realloc(
p_j2k->cstr_index->tile_index[p_j2k->m_current_tile_number].tp_index,
p_j2k->cstr_index->tile_index[p_j2k->m_current_tile_number].current_nb_tps * sizeof(opj_tp_index_t));
};
#endif /* USE_JPWL */
+ /* testcase 3635.pdf.asan.77.2930 */
+ if (l_comp_room >= l_nb_comp) {
+ opj_event_msg(p_manager, EVT_ERROR,
+ "JPWL: bad component number in RGN (%d when there are only %d)\n",
+ l_comp_room, l_nb_comp);
+ return OPJ_FALSE;
+ }
+
opj_read_bytes(p_header_data,(OPJ_UINT32 *) (&(l_tcp->tccps[l_comp_no].roishift)),1); /* SPrgn */
++p_header_data;
/* Read 2 bytes from the buffer as the marker size */
opj_read_bytes(p_j2k->m_specific_param.m_decoder.m_header_data,&l_marker_size,2);
+ /* cf. https://code.google.com/p/openjpeg/issues/detail?id=226 */
+ if (l_current_marker == 0x8080 && opj_stream_get_number_byte_left(p_stream) == 0) {
+ p_j2k->m_specific_param.m_decoder.m_state = J2K_STATE_NEOC;
+ break;
+ }
+
/* Why this condition? FIXME */
if (p_j2k->m_specific_param.m_decoder.m_state & J2K_STATE_TPH){
p_j2k->m_specific_param.m_decoder.m_sot_length -= (l_marker_size + 2);