third_party/libopenjpeg20/0019-tcd_init_tile.patch - Issue 2212973002: openjpeg: Prevent integer overflows during calculation of |l_nb_code_blocks_size|

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: third_party/libopenjpeg20/0019-tcd_init_tile.patch

Issue 2212973002: openjpeg: Prevent integer overflows during calculation of |l_nb_code_blocks_size| (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master

Patch Set: openjpeg: Prevent integer overflows during calculation of |l_nb_code_blocks_size| Created 4 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20 /README.pdfium

	2 index a9e289d..b1012af 100644

	3 --- a/third_party/libopenjpeg20/README.pdfium

	4 +++ b/third_party/libopenjpeg20/README.pdfium

	5 @@ -28,4 +28,5 @@ Local Modifications:

	6 0016-read_SQcd_SQcc_overflow.patch: Prevent a buffer overflow in opj_j2k_read_S Qcd_SQcc.

	7 0017-tcd_init_tile.patch: Prevent integer overflows during calculation of \|l_nb _precinct_size\|.

	8 0018-tcd_get_decoded_tile_size.patch: Fix an integer overflow in opj_tcd_get_de coded_tile_size.

	9 +0019-tcd_init_tile.patch: Prevent integer overflows during calculation of \|l_nb _code_blocks_size\|.

	10 TODO(thestig): List all the other patches.

	11 diff --git a/third_party/libopenjpeg20/tcd.c b/third_party/libopenjpeg20/tcd.c

	12 index cd1c439..9270efe 100644

	13 --- a/third_party/libopenjpeg20/tcd.c

	14 +++ b/third_party/libopenjpeg20/tcd.c

	15 @@ -939,8 +939,15 @@ static INLINE OPJ_BOOL opj_tcd_init_tile(opj_tcd_t *p_tcd, OPJ_UINT32 p_tile_no,

	16 l_current_precinct->cw = (OPJ_UINT32)((b rcblkxend - tlcblkxstart) >> cblkwidthexpn);

	17 l_current_precinct->ch = (OPJ_UINT32)((b rcblkyend - tlcblkystart) >> cblkheightexpn);

	18

	19 + if (l_current_precinct->cw && ((OPJ_UINT 32)-1) / l_current_precinct->cw < l_current_precinct->ch) {

	20 + return OPJ_FALSE;

	21 + }

	22 l_nb_code_blocks = l_current_precinct->c w * l_current_precinct->ch;

	23 /fprintf(stderr, "\t\t\t\t precinct_cw = %d x recinct_ch = %d\n",l_current_precinct->cw, l_current_precinct->ch); /

	24 +

	25 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeo f_block < l_nb_code_blocks) {

	26 + return OPJ_FALSE;

	27 + }

	28 l_nb_code_blocks_size = l_nb_code_blocks * (OPJ_UINT32)sizeof_block;

	29

	30 if (! l_current_precinct->cblks.blocks) {

OLD	NEW

« no previous file with comments | « AUTHORS ('k') | third_party/libopenjpeg20/README.pdfium » ('j') | no next file with comments »