projects
/
openjpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
90312af
)
opj_decompress: fix off-by-one read heap-buffer-overflow in sycc420_to_rgb() when...
1509/head
author
Even Rouault
<even.rouault@spatialys.com>
Sun, 18 Feb 2024 16:02:25 +0000
(17:02 +0100)
committer
Even Rouault
<even.rouault@spatialys.com>
Sun, 18 Feb 2024 16:02:25 +0000
(17:02 +0100)
src/bin/common/color.c
patch
|
blob
|
history
diff --git
a/src/bin/common/color.c
b/src/bin/common/color.c
index 27f15f137f73ee7aa6c6ae4b531368157a86ba26..ae5d648da6e9ccfdc3c8f324f8bf685dc10f8be2 100644
(file)
--- a/
src/bin/common/color.c
+++ b/
src/bin/common/color.c
@@
-358,7
+358,15
@@
static void sycc420_to_rgb(opj_image_t *img)
if (i < loopmaxh) {
size_t j;
- for (j = 0U; j < (maxw & ~(size_t)1U); j += 2U) {
+ if (offx > 0U) {
+ sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
+ ++y;
+ ++r;
+ ++g;
+ ++b;
+ }
+
+ for (j = 0U; j < (loopmaxw & ~(size_t)1U); j += 2U) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++y;
@@
-375,7
+383,7
@@
static void sycc420_to_rgb(opj_image_t *img)
++cb;
++cr;
}
- if (j < maxw) {
+ if (j <
loop
maxw) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
}
}