Fix undefined size jp2 box handling

[openjpeg.git] / src / lib / openjp2 / jp2.c

diff --git a/src/lib/openjp2/jp2.c b/src/lib/openjp2/jp2.c
index c14e9a066726673b18cab8d989f95188b377a06a..6c6f6e83504ece80ac4a4bdd2ca74e0e4fa828bb 100644 (file)
--- a/src/lib/openjp2/jp2.c
+++ b/src/lib/openjp2/jp2.c
@@ -94,7 +94,7 @@ static OPJ_BYTE * opj_jp2_write_bpcc( opj_jp2_t *jp2,
  * @param      p_bpc_header_size                       the size of the bpc header
  * @param      p_manager                                       the user event manager.
  *
- * @return     true if the bpc header is valid, fale else.
+ * @return     true if the bpc header is valid, false else.
  */
 static OPJ_BOOL opj_jp2_read_bpcc(  opj_jp2_t *jp2,
                                     OPJ_BYTE * p_bpc_header_data,
@@ -311,7 +311,7 @@ static OPJ_BOOL opj_jp2_read_cmap(  opj_jp2_t * jp2,
  * @param      p_colr_header_size                      the size of the color header
  * @param      p_manager                                       the user event manager.
  *
- * @return     true if the bpc header is valid, fale else.
+ * @return     true if the bpc header is valid, false else.
 */
 static OPJ_BOOL opj_jp2_read_colr(  opj_jp2_t *jp2,
                                     OPJ_BYTE * p_colr_header_data,
@@ -482,12 +482,16 @@ static OPJ_BOOL opj_jp2_read_boxhdr(opj_jp2_box_t *box,
        opj_read_bytes(l_data_header+4,&(box->type), 4);
     
   if(box->length == 0)/* last box */
-    {
+  {
     const OPJ_OFF_T bleft = opj_stream_get_number_byte_left(cio);
-    box->length = (OPJ_UINT32)bleft;
-    assert( (OPJ_OFF_T)box->length == bleft );
-    return OPJ_TRUE;
+    if (bleft > (OPJ_OFF_T)(0xFFFFFFFFU - 8U)) {
+      opj_event_msg(p_manager, EVT_ERROR, "Cannot handle box sizes higher than 2^32\n");
+      return OPJ_FALSE;
     }
+    box->length = (OPJ_UINT32)bleft + 8U;
+    assert( (OPJ_OFF_T)box->length == bleft + 8 );
+    return OPJ_TRUE;
+  }
 
        /* do we have a "special very large box ?" */
        /* read then the XLBox */
@@ -2112,7 +2116,7 @@ static OPJ_BOOL opj_jp2_read_header_procedure(  opj_jp2_t *jp2,
                if (box.type == JP2_JP2C) {
                        if (jp2->jp2_state & JP2_STATE_HEADER) {
                                jp2->jp2_state |= JP2_STATE_CODESTREAM;
-                                opj_free(l_current_data);
+                               opj_free(l_current_data);
                                return OPJ_TRUE;
                        }
                        else {
@@ -2127,7 +2131,7 @@ static OPJ_BOOL opj_jp2_read_header_procedure(  opj_jp2_t *jp2,
                        return OPJ_FALSE;
                }
                /* testcase 1851.pdf.SIGSEGV.ce9.948 */
-        else if (box.length < l_nb_bytes_read) {
+               else if (box.length < l_nb_bytes_read) {
                        opj_event_msg(p_manager, EVT_ERROR, "invalid box size %d (%x)\n", box.length, box.type);
                        opj_free(l_current_data);
                        return OPJ_FALSE;
@@ -2184,16 +2188,16 @@ static OPJ_BOOL opj_jp2_read_header_procedure(  opj_jp2_t *jp2,
                        }
                }
                else {
-            if (!(jp2->jp2_state & JP2_STATE_SIGNATURE)) {
-                opj_event_msg(p_manager, EVT_ERROR, "Malformed JP2 file format: first box must be JPEG 2000 signature box\n");
-                opj_free(l_current_data);
-                return OPJ_FALSE;
-            }
-            if (!(jp2->jp2_state & JP2_STATE_FILE_TYPE)) {
-                opj_event_msg(p_manager, EVT_ERROR, "Malformed JP2 file format: second box must be file type box\n");
-                opj_free(l_current_data);
-                return OPJ_FALSE;
-            }
+                       if (!(jp2->jp2_state & JP2_STATE_SIGNATURE)) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Malformed JP2 file format: first box must be JPEG 2000 signature box\n");
+                               opj_free(l_current_data);
+                               return OPJ_FALSE;
+                       }
+                       if (!(jp2->jp2_state & JP2_STATE_FILE_TYPE)) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Malformed JP2 file format: second box must be file type box\n");
+                               opj_free(l_current_data);
+                               return OPJ_FALSE;
+                       }
                        jp2->jp2_state |= JP2_STATE_UNKNOWN;
                        if (opj_stream_skip(stream,l_current_data_size,p_manager) != l_current_data_size) {
                                opj_event_msg(p_manager, EVT_ERROR, "Problem with skipping JPEG2000 box, stream error\n");