third_party/libopenjpeg20/0017-tcd_init_tile.patch - Issue 2124073003: openjpeg: Prevent integer overflows during calculation of |l_nb_precinct_size|

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: third_party/libopenjpeg20/0017-tcd_init_tile.patch

Issue 2124073003: openjpeg: Prevent integer overflows during calculation of |l_nb_precinct_size| (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master

Patch Set: Created 4 years, 5 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 diff --git a/third_party/libopenjpeg20/0017-tcd_init_tile.patch b/third_party/li bopenjpeg20/0017-tcd_init_tile.patch

	2 new file mode 100644

	3 index 0000000..e69de29

	4 diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20 /README.pdfium

	5 index 4852a42..97e6e8c 100644

	6 --- a/third_party/libopenjpeg20/README.pdfium

	7 +++ b/third_party/libopenjpeg20/README.pdfium

	8 @@ -26,4 +26,5 @@ Local Modifications:

	9 0014-opj_jp2_read_ihdr_leak.patch: Memory leak in opj_jp2_read_ihdr().

	10 0015-read_SPCod_SPCoc_overflow.patch: Prevent a buffer overflow in opj_j2k_read _SPCod_SPCoc.

	11 0016-read_SQcd_SQcc_overflow.patch: Prevent a buffer overflow in opj_j2k_read_S Qcd_SQcc.

	12 +0017-tcd_init_tile.patch: Prevent integer overflows during calculation of \|l_nb _precinct_size\|.

	13 TODO(thestig): List all the other patches.

	14 diff --git a/third_party/libopenjpeg20/tcd.c b/third_party/libopenjpeg20/tcd.c

	15 index aebe9be..673633c 100644

	16 --- a/third_party/libopenjpeg20/tcd.c

	17 +++ b/third_party/libopenjpeg20/tcd.c

	18 @@ -822,7 +822,14 @@ static INLINE OPJ_BOOL opj_tcd_init_tile(opj_tcd_t *p_tcd, OPJ_UINT32 p_tile_no,

	19 l_res->ph = (l_res->y0 == l_res->y1) ? 0 : (OPJ_UINT32)( (l_br_prc_y_end - l_tl_prc_y_start) >> l_pdy);

	20 /fprintf(stderr, "\t\t\tres_pw=%d, res_ph=%d\n", l_res- >pw, l_res->ph );/

	21

	22 + if (l_res->pw && ((OPJ_UINT32)-1) / l_res->pw < l_res->p h) {

	23 + return OPJ_FALSE;

	24 + }

	25 l_nb_precincts = l_res->pw * l_res->ph;

	26 +

	27 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_tcd_precin ct_t) < l_nb_precincts) {

	28 + return OPJ_FALSE;

	29 + }

	30 l_nb_precinct_size = l_nb_precincts * (OPJ_UINT32)sizeof (opj_tcd_precinct_t);

	31 if (resno == 0) {

	32 tlcbgxstart = l_tl_prc_x_start;

OLD	NEW

« no previous file with comments | « no previous file | third_party/libopenjpeg20/README.pdfium » ('j') | no next file with comments »