Merge pull request #1160 from hlef/master

jp3d/jpwl convert: fix write stack buffer overflow

diff --git a/src/bin/jp2/convertbmp.c b/src/bin/jp2/convertbmp.c
index 7fde99ab3ef21f6a043ba1d8ada85d5030a943fe..85a47feaf3b986684b531a45bda50a0bb5e6ba3a 100644 (file)
--- a/src/bin/jp2/convertbmp.c
+++ b/src/bin/jp2/convertbmp.c
@@ -763,7 +763,7 @@ opj_image_t* bmptoimage(const char *filename, opj_cparameters_t *parameters)
         fclose(IN);
         return NULL;
     }
-    pData = (OPJ_UINT8 *) calloc(1, stride * Info_h.biHeight * sizeof(OPJ_UINT8));
+    pData = (OPJ_UINT8 *) calloc(1, sizeof(OPJ_UINT8) * stride * Info_h.biHeight);
     if (pData == NULL) {
         fclose(IN);
         return NULL;

diff --git a/src/bin/jp2/converttif.c b/src/bin/jp2/converttif.c
index 6e5c4f400438fcf1c2cffbda47fb7f226abeea85..6714d69c72996c3814058027391dbfc341e8f514 100644 (file)
--- a/src/bin/jp2/converttif.c
+++ b/src/bin/jp2/converttif.c
@@ -725,8 +725,7 @@ int imagetotif(opj_image_t * image, const char *outfile)
         TIFFClose(tif);
         return 1;
     }
-    buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(width * numcomps * sizeof(
-                                        OPJ_INT32)));
+    buffer32s = (OPJ_INT32 *)malloc(sizeof(OPJ_INT32) * width * numcomps);
     if (buffer32s == NULL) {
         _TIFFfree(buf);
         TIFFClose(tif);
@@ -1447,8 +1446,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters)
     }
 
     rowStride = (int64_t)((tiWidth * tiSpp * tiBps + 7U) / 8U);
-    buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(tiWidth * tiSpp * sizeof(
-                                        OPJ_INT32)));
+    buffer32s = (OPJ_INT32 *)malloc(sizeof(OPJ_INT32) * tiWidth * tiSpp);
     if (buffer32s == NULL) {
         _TIFFfree(buf);
         TIFFClose(tif);

diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c
index 3131a433429faa246346ece7c5545a19e476d20a..148bf951d748214fbfcf41010298e8095927f0f1 100644 (file)
--- a/src/bin/jp2/opj_compress.c
+++ b/src/bin/jp2/opj_compress.c
@@ -824,7 +824,7 @@ static int parse_cmdline_encoder(int argc, char **argv,
             parameters->tcp_numlayers = (int)numlayers;
             numresolution = (OPJ_UINT32)parameters->numresolution;
             matrix_width = numresolution * 3;
-            parameters->cp_matrice = (int *) malloc(numlayers * matrix_width * sizeof(int));
+            parameters->cp_matrice = (int *) malloc(sizeof(int) * numlayers * matrix_width);
             if (parameters->cp_matrice == NULL) {
                 return 1;
             }
@@ -1739,6 +1739,8 @@ int main(int argc, char **argv)
     img_fol_t img_fol;
     dircnt_t *dirptr = NULL;
 
+    int ret = 0;
+
     OPJ_BOOL bSuccess;
     OPJ_BOOL bUseTiles = OPJ_FALSE; /* OPJ_TRUE */
     OPJ_UINT32 l_nb_tiles = 4;
@@ -1764,7 +1766,8 @@ int main(int argc, char **argv)
                          255; /* This will be set later according to the input image or the provided option */
     if (parse_cmdline_encoder(argc, argv, &parameters, &img_fol, &raw_cp,
                               indexfilename, sizeof(indexfilename)) == 1) {
-        goto fails;
+        ret = 1;
+        goto fin;
     }
 
     /* Read directory if necessary */
@@ -1776,18 +1779,21 @@ int main(int argc, char **argv)
                     char)); /* Stores at max 10 image file names*/
             dirptr->filename = (char**) malloc(num_images * sizeof(char*));
             if (!dirptr->filename_buf) {
-                return 0;
+                ret = 0;
+                goto fin;
             }
             for (i = 0; i < num_images; i++) {
                 dirptr->filename[i] = dirptr->filename_buf + i * OPJ_PATH_LEN;
             }
         }
         if (load_images(dirptr, img_fol.imgdirpath) == 1) {
-            return 0;
+            ret = 0;
+            goto fin;
         }
         if (num_images == 0) {
             fprintf(stdout, "Folder is empty\n");
-            return 0;
+            ret = 0;
+            goto fin;
         }
     } else {
         num_images = 1;
@@ -1833,7 +1839,8 @@ int main(int argc, char **argv)
             image = pgxtoimage(parameters.infile, &parameters);
             if (!image) {
                 fprintf(stderr, "Unable to load pgx file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 
@@ -1841,7 +1848,8 @@ int main(int argc, char **argv)
             image = pnmtoimage(parameters.infile, &parameters);
             if (!image) {
                 fprintf(stderr, "Unable to load pnm file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 
@@ -1849,7 +1857,8 @@ int main(int argc, char **argv)
             image = bmptoimage(parameters.infile, &parameters);
             if (!image) {
                 fprintf(stderr, "Unable to load bmp file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 
@@ -1858,7 +1867,8 @@ int main(int argc, char **argv)
             image = tiftoimage(parameters.infile, &parameters);
             if (!image) {
                 fprintf(stderr, "Unable to load tiff file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 #endif /* OPJ_HAVE_LIBTIFF */
@@ -1867,7 +1877,8 @@ int main(int argc, char **argv)
             image = rawtoimage(parameters.infile, &parameters, &raw_cp);
             if (!image) {
                 fprintf(stderr, "Unable to load raw file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 
@@ -1875,7 +1886,8 @@ int main(int argc, char **argv)
             image = rawltoimage(parameters.infile, &parameters, &raw_cp);
             if (!image) {
                 fprintf(stderr, "Unable to load raw file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 
@@ -1883,7 +1895,8 @@ int main(int argc, char **argv)
             image = tgatoimage(parameters.infile, &parameters);
             if (!image) {
                 fprintf(stderr, "Unable to load tga file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 
@@ -1892,7 +1905,8 @@ int main(int argc, char **argv)
             image = pngtoimage(parameters.infile, &parameters);
             if (!image) {
                 fprintf(stderr, "Unable to load png file\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             break;
 #endif /* OPJ_HAVE_LIBPNG */
@@ -1903,7 +1917,8 @@ int main(int argc, char **argv)
         */
         if (!image) {
             fprintf(stderr, "Unable to load file: got no image\n");
-            return 1;
+            ret = 1;
+            goto fin;
         }
 
         /* Decide if MCT should be used */
@@ -1914,12 +1929,14 @@ int main(int argc, char **argv)
             if ((parameters.tcp_mct == 1) && (image->numcomps < 3)) {
                 fprintf(stderr, "RGB->YCC conversion cannot be used:\n");
                 fprintf(stderr, "Input image has less than 3 components\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
             if ((parameters.tcp_mct == 2) && (!parameters.mct_data)) {
                 fprintf(stderr, "Custom MCT has been set but no array-based MCT\n");
                 fprintf(stderr, "has been provided. Aborting.\n");
-                return 1;
+                ret = 1;
+                goto fin;
             }
         }
 
@@ -1959,13 +1976,15 @@ int main(int argc, char **argv)
             fprintf(stderr, "failed to encode image: opj_setup_encoder\n");
             opj_destroy_codec(l_codec);
             opj_image_destroy(image);
-            return 1;
+            ret = 1;
+            goto fin;
         }
 
         /* open a byte stream for writing and allocate memory for all tiles */
         l_stream = opj_stream_create_default_file_stream(parameters.outfile, OPJ_FALSE);
         if (! l_stream) {
-            return 1;
+            ret = 1;
+            goto fin;
         }
 
         /* encode the image */
@@ -1978,7 +1997,8 @@ int main(int argc, char **argv)
             OPJ_UINT32 l_data_size = 512 * 512 * 3;
             l_data = (OPJ_BYTE*) calloc(1, l_data_size);
             if (l_data == NULL) {
-                goto fails;
+                ret = 1;
+                goto fin;
             }
             for (i = 0; i < l_nb_tiles; ++i) {
                 if (! opj_write_tile(l_codec, i, l_data, l_data_size, l_stream)) {
@@ -1987,7 +2007,8 @@ int main(int argc, char **argv)
                     opj_stream_destroy(l_stream);
                     opj_destroy_codec(l_codec);
                     opj_image_destroy(image);
-                    return 1;
+                    ret = 1;
+                    goto fin;
                 }
             }
             free(l_data);
@@ -2008,7 +2029,8 @@ int main(int argc, char **argv)
             opj_image_destroy(image);
             fprintf(stderr, "failed to encode image\n");
             remove(parameters.outfile);
-            return 1;
+            ret = 1;
+            goto fin;
         }
 
         num_compressed_files++;
@@ -2024,26 +2046,15 @@ int main(int argc, char **argv)
 
     }
 
-    /* free user parameters structure */
-    if (parameters.cp_comment) {
-        free(parameters.cp_comment);
-    }
-    if (parameters.cp_matrice) {
-        free(parameters.cp_matrice);
-    }
-    if (raw_cp.rawComps) {
-        free(raw_cp.rawComps);
-    }
-
     t = opj_clock() - t;
     if (num_compressed_files) {
         fprintf(stdout, "encode time: %d ms \n",
                 (int)((t * 1000.0) / (OPJ_FLOAT64)num_compressed_files));
     }
 
-    return 0;
+    ret = 0;
 
-fails:
+fin:
     if (parameters.cp_comment) {
         free(parameters.cp_comment);
     }
@@ -2065,5 +2076,5 @@ fails:
         }
         free(dirptr);
     }
-    return 1;
+    return ret;
 }

diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c
index a28a194bb7c738d23bc121d2d4c79d33fe021d91..4b9583b798e0c245b72cfff1b0c70b50e2ff4525 100644 (file)
--- a/src/bin/jp2/opj_decompress.c
+++ b/src/bin/jp2/opj_decompress.c
@@ -1119,11 +1119,11 @@ static opj_image_t* convert_gray_to_rgb(opj_image_t* original)
             l_new_image->comps[2].resno_decoded = original->comps[0].resno_decoded;
 
     memcpy(l_new_image->comps[0].data, original->comps[0].data,
-           original->comps[0].w * original->comps[0].h * sizeof(OPJ_INT32));
+           sizeof(OPJ_INT32) * original->comps[0].w * original->comps[0].h);
     memcpy(l_new_image->comps[1].data, original->comps[0].data,
-           original->comps[0].w * original->comps[0].h * sizeof(OPJ_INT32));
+           sizeof(OPJ_INT32) * original->comps[0].w * original->comps[0].h);
     memcpy(l_new_image->comps[2].data, original->comps[0].data,
-           original->comps[0].w * original->comps[0].h * sizeof(OPJ_INT32));
+           sizeof(OPJ_INT32) * original->comps[0].w * original->comps[0].h);
 
     for (compno = 1U; compno < original->numcomps; ++compno) {
         l_new_image->comps[compno + 2U].factor        = original->comps[compno].factor;
@@ -1131,7 +1131,7 @@ static opj_image_t* convert_gray_to_rgb(opj_image_t* original)
         l_new_image->comps[compno + 2U].resno_decoded =
             original->comps[compno].resno_decoded;
         memcpy(l_new_image->comps[compno + 2U].data, original->comps[compno].data,
-               original->comps[compno].w * original->comps[compno].h * sizeof(OPJ_INT32));
+               sizeof(OPJ_INT32) * original->comps[compno].w * original->comps[compno].h);
     }
     opj_image_destroy(original);
     return l_new_image;
@@ -1301,7 +1301,7 @@ static opj_image_t* upsample_image_components(opj_image_t* original)
             }
         } else {
             memcpy(l_new_cmp->data, l_org_cmp->data,
-                   l_org_cmp->w * l_org_cmp->h * sizeof(OPJ_INT32));
+                   sizeof(OPJ_INT32) * l_org_cmp->w * l_org_cmp->h);
         }
     }
     opj_image_destroy(original);
@@ -1360,8 +1360,9 @@ int main(int argc, char **argv)
             destroy_parameters(&parameters);
             return EXIT_FAILURE;
         }
-        dirptr->filename_buf = (char*)malloc((size_t)num_images * OPJ_PATH_LEN * sizeof(
-                char)); /* Stores at max 10 image file names*/
+        /* Stores at max 10 image file names */
+        dirptr->filename_buf = (char*)malloc(sizeof(char) *
+                                             (size_t)num_images * OPJ_PATH_LEN);
         if (!dirptr->filename_buf) {
             failed = 1;
             goto fin;

diff --git a/src/lib/openjp2/dwt.c b/src/lib/openjp2/dwt.c
index 203684d480ae486a2366c7c72e479b53a86de0c8..5930d1c71e89831a1a975fa24c9f42ad7dbca91b 100644 (file)
--- a/src/lib/openjp2/dwt.c
+++ b/src/lib/openjp2/dwt.c
@@ -2696,17 +2696,20 @@ OPJ_BOOL opj_dwt_decode_partial_97(opj_tcd_tilecomp_t* OPJ_RESTRICT tilec,
     /* overflow check */
     if (l_data_size > (SIZE_MAX - 5U)) {
         /* FIXME event manager error callback */
+        opj_sparse_array_int32_free(sa);
         return OPJ_FALSE;
     }
     l_data_size += 5U;
     /* overflow check */
     if (l_data_size > (SIZE_MAX / sizeof(opj_v4_t))) {
         /* FIXME event manager error callback */
+        opj_sparse_array_int32_free(sa);
         return OPJ_FALSE;
     }
     h.wavelet = (opj_v4_t*) opj_aligned_malloc(l_data_size * sizeof(opj_v4_t));
     if (!h.wavelet) {
         /* FIXME event manager error callback */
+        opj_sparse_array_int32_free(sa);
         return OPJ_FALSE;
     }
     v.wavelet = h.wavelet;

diff --git a/src/lib/openjp2/jp2.c b/src/lib/openjp2/jp2.c
index 180a416b7efd4d7e56a5c5c821eb6f9081913792..4402ffe3c51ee347d3a0ef04a54dc89846859fd8 100644 (file)
--- a/src/lib/openjp2/jp2.c
+++ b/src/lib/openjp2/jp2.c
@@ -1079,7 +1079,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
 
         /* Palette mapping: */
         new_comps[i].data = (OPJ_INT32*)
-                            opj_image_data_alloc(old_comps[cmp].w * old_comps[cmp].h * sizeof(OPJ_INT32));
+                            opj_image_data_alloc(sizeof(OPJ_INT32) * old_comps[cmp].w * old_comps[cmp].h);
         if (!new_comps[i].data) {
             while (i > 0) {
                 -- i;
@@ -1193,8 +1193,8 @@ static OPJ_BOOL opj_jp2_read_pclr(opj_jp2_t *jp2,
         return OPJ_FALSE;
     }
 
-    entries = (OPJ_UINT32*) opj_malloc((size_t)nr_channels * nr_entries * sizeof(
-                                           OPJ_UINT32));
+    entries = (OPJ_UINT32*) opj_malloc(sizeof(OPJ_UINT32) * nr_channels *
+                                       nr_entries);
     if (!entries) {
         return OPJ_FALSE;
     }

diff --git a/src/lib/openjp2/t1.c b/src/lib/openjp2/t1.c
index 76744380f766c26ebf6ee7b4941d7f3214f495e1..ec04c682525fc96d6eaa73687ba65dd6e60fedb1 100644 (file)
--- a/src/lib/openjp2/t1.c
+++ b/src/lib/openjp2/t1.c
@@ -1618,8 +1618,8 @@ static void opj_t1_clbl_decode_processor(void* user_data, opj_tls_t* tls)
         cblk_w = (OPJ_UINT32)(cblk->x1 - cblk->x0);
         cblk_h = (OPJ_UINT32)(cblk->y1 - cblk->y0);
 
-        cblk->decoded_data = (OPJ_INT32*)opj_aligned_malloc(cblk_w * cblk_h * sizeof(
-                                 OPJ_INT32));
+        cblk->decoded_data = (OPJ_INT32*)opj_aligned_malloc(sizeof(OPJ_INT32) *
+                             cblk_w * cblk_h);
         if (cblk->decoded_data == NULL) {
             if (job->p_manager_mutex) {
                 opj_mutex_lock(job->p_manager_mutex);
@@ -1634,7 +1634,7 @@ static void opj_t1_clbl_decode_processor(void* user_data, opj_tls_t* tls)
             return;
         }
         /* Zero-init required */
-        memset(cblk->decoded_data, 0, cblk_w * cblk_h * sizeof(OPJ_INT32));
+        memset(cblk->decoded_data, 0, sizeof(OPJ_INT32) * cblk_w * cblk_h);
     } else if (cblk->decoded_data) {
         /* Not sure if that code path can happen, but better be */
         /* safe than sorry */

diff --git a/src/lib/openjp2/thread.c b/src/lib/openjp2/thread.c
index af33c2c8062ffefd404a6c523c58522bce2389f5..f2fca2ee4af8e395cab361f053b90c21b30952e5 100644 (file)
--- a/src/lib/openjp2/thread.c
+++ b/src/lib/openjp2/thread.c
@@ -723,6 +723,8 @@ static OPJ_BOOL opj_thread_pool_setup(opj_thread_pool_t* tp, int num_threads)
         tp->worker_threads[i].thread = opj_thread_create(opj_worker_thread_function,
                                        &(tp->worker_threads[i]));
         if (tp->worker_threads[i].thread == NULL) {
+            opj_mutex_destroy(tp->worker_threads[i].mutex);
+            opj_cond_destroy(tp->worker_threads[i].cond);
             tp->worker_threads_count = i;
             bRet = OPJ_FALSE;
             break;
@@ -732,7 +734,7 @@ static OPJ_BOOL opj_thread_pool_setup(opj_thread_pool_t* tp, int num_threads)
     /* Wait all threads to be started */
     /* printf("waiting for all threads to be started\n"); */
     opj_mutex_lock(tp->mutex);
-    while (tp->waiting_worker_thread_count < num_threads) {
+    while (tp->waiting_worker_thread_count < tp->worker_threads_count) {
         opj_cond_wait(tp->cond, tp->mutex);
     }
     opj_mutex_unlock(tp->mutex);

diff --git a/src/lib/openjp3d/tcd.c b/src/lib/openjp3d/tcd.c
index 013a9f1ac59d29ce1848ea3b1f30518e0b67b6a3..714a0565d5dc13840fe94632a03fa73d6df388c9 100644 (file)
--- a/src/lib/openjp3d/tcd.c
+++ b/src/lib/openjp3d/tcd.c
@@ -226,10 +226,10 @@ void tcd_malloc_encode(opj_tcd_t *tcd, opj_volume_t * volume, opj_cp_t * cp,
         if (tcp->rates[j] <= 1) {
             tcp->rates[j] = 0;
         } else {
-            float num = (float)(tile->numcomps * (tile->x1 - tile->x0) *
-                                (tile->y1 - tile->y0) * (tile->z1 - tile->z0) * volume->comps[0].prec);
-            float den = (float)(8 * volume->comps[0].dx * volume->comps[0].dy *
-                                volume->comps[0].dz);
+            float num = (float)tile->numcomps * (tile->x1 - tile->x0) *
+                        (tile->y1 - tile->y0) * (tile->z1 - tile->z0) * volume->comps[0].prec;
+            float den = 8.0f * volume->comps[0].dx * volume->comps[0].dy *
+                        volume->comps[0].dz;
             den = tcp->rates[j] * den;
             tcp->rates[j] = (num + den - 1) / den;
         }
@@ -537,10 +537,10 @@ void tcd_init_encode(opj_tcd_t *tcd, opj_volume_t * volume, opj_cp_t * cp,
         if (tcp->rates[j] <= 1) {
             tcp->rates[j] = 0;
         } else {
-            float num = (float)(tile->numcomps * (tile->x1 - tile->x0) *
-                                (tile->y1 - tile->y0) * (tile->z1 - tile->z0) * volume->comps[0].prec);
-            float den = (float)(8 * volume->comps[0].dx * volume->comps[0].dy *
-                                volume->comps[0].dz);
+            float num = (float)tile->numcomps * (tile->x1 - tile->x0) *
+                        (tile->y1 - tile->y0) * (tile->z1 - tile->z0) * volume->comps[0].prec;
+            float den = 8.0f * volume->comps[0].dx * volume->comps[0].dy *
+                        volume->comps[0].dz;
             den = tcp->rates[j] * den;
             tcp->rates[j] = (num + den - 1) / den;
         }

diff --git a/src/lib/openmj2/j2k.c b/src/lib/openmj2/j2k.c
index 85f7b40ee5ec0833205b4fd1c19313e71c16ccbd..daf13f80e25012136f5135eeb05282c827073d33 100644 (file)
--- a/src/lib/openmj2/j2k.c
+++ b/src/lib/openmj2/j2k.c
@@ -331,7 +331,7 @@ static int j2k_calculate_tp(opj_cp_t *cp, int img_numcomp, opj_image_t *image,
 
     OPJ_ARG_NOT_USED(img_numcomp);
 
-    j2k->cur_totnum_tp = (int *) opj_malloc(cp->tw * cp->th * sizeof(int));
+    j2k->cur_totnum_tp = (int *) opj_malloc(sizeof(int) * cp->tw * cp->th);
     for (tileno = 0; tileno < cp->tw * cp->th; tileno++) {
         int cur_totnum_tp = 0;
         opj_tcp_t *tcp = &cp->tcps[tileno];
@@ -611,7 +611,7 @@ static void j2k_read_siz(opj_j2k_t *j2k)
         opj_event_msg(j2k->cinfo, EVT_ERROR, "Out of memory\n");
         return;
     }
-    cp->tileno = (int*) opj_malloc(cp->tw * cp->th * sizeof(int));
+    cp->tileno = (int*) opj_malloc(sizeof(int) * cp->tw * cp->th);
     if (cp->tileno == NULL) {
         opj_event_msg(j2k->cinfo, EVT_ERROR, "Out of memory\n");
         return;

diff --git a/src/lib/openmj2/jp2.c b/src/lib/openmj2/jp2.c
index d2ca41f01ffecd93c0ff498cb5f32f16c7f36607..acf64b9a86392cefa6384626ea3c0cf8629c1e08 100644 (file)
--- a/src/lib/openmj2/jp2.c
+++ b/src/lib/openmj2/jp2.c
@@ -393,7 +393,7 @@ static void jp2_apply_pclr(opj_jp2_color_t *color, opj_image_t *image,
         }
         /* Palette mapping: */
         new_comps[pcol].data = (int*)
-                               opj_malloc(old_comps[cmp].w * old_comps[cmp].h * sizeof(int));
+                               opj_malloc(sizeof(int) * old_comps[cmp].w * old_comps[cmp].h);
         new_comps[pcol].prec = channel_size[i];
         new_comps[pcol].sgnd = channel_sign[i];
     }
@@ -461,7 +461,7 @@ static opj_bool jp2_read_pclr(opj_jp2_t *jp2, opj_cio_t *cio,
     nr_channels = (unsigned short)cio_read(cio, 1);/* NPC */
 
     entries = (unsigned int*)
-              opj_malloc(nr_channels * nr_entries * sizeof(unsigned int));
+              opj_malloc(sizeof(unsigned int) * nr_channels * nr_entries);
     channel_size = (unsigned char*)opj_malloc(nr_channels);
     channel_sign = (unsigned char*)opj_malloc(nr_channels);