| OLD | NEW |
|---|
| (Empty) | |
| 1 diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20
/README.pdfium |
| 2 index b1012af..a40ed7b 100644 |
| 3 --- a/third_party/libopenjpeg20/README.pdfium |
| 4 +++ b/third_party/libopenjpeg20/README.pdfium |
| 5 @@ -29,4 +29,5 @@ Local Modifications: |
| 6 0017-tcd_init_tile.patch: Prevent integer overflows during calculation of |l_nb
_precinct_size|. |
| 7 0018-tcd_get_decoded_tile_size.patch: Fix an integer overflow in opj_tcd_get_de
coded_tile_size. |
| 8 0019-tcd_init_tile.patch: Prevent integer overflows during calculation of |l_nb
_code_blocks_size|. |
| 9 +0020-opj_aligned_malloc.patch: Prevent overflows when using opj_aligned_malloc(
). |
| 10 TODO(thestig): List all the other patches. |
| 11 diff --git a/third_party/libopenjpeg20/dwt.c b/third_party/libopenjpeg20/dwt.c |
| 12 index 3b92bdf..a666d1c 100644 |
| 13 --- a/third_party/libopenjpeg20/dwt.c |
| 14 +++ b/third_party/libopenjpeg20/dwt.c |
| 15 @@ -576,6 +576,9 @@ static OPJ_BOOL opj_dwt_decode_tile(const opj_tcd_tilecomp_t
* tilec, OPJ_UINT32 |
| 16 OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0); |
| 17 |
| 18 h.mem_count = opj_dwt_max_resolution(tr, numres); |
| 19 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < (OPJ_UINT32)h.mem
_count) { |
| 20 + return OPJ_FALSE; |
| 21 + } |
| 22 h.mem = (OPJ_INT32*)opj_aligned_malloc(h.mem_count * sizeof(OPJ_INT32)); |
| 23 if (! h.mem){ |
| 24 /* FIXME event manager error callback */ |
| 25 @@ -850,7 +853,17 @@ OPJ_BOOL opj_dwt_decode_real(opj_tcd_tilecomp_t* restrict t
ilec, OPJ_UINT32 numr |
| 26 |
| 27 OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0); |
| 28 |
| 29 - h.wavelet = (opj_v4_t*) opj_aligned_malloc((opj_dwt_max_resolution(res,
numres)+5) * sizeof(opj_v4_t)); |
| 30 + OPJ_UINT32 mr = opj_dwt_max_resolution(res, numres); |
| 31 + |
| 32 + if (mr >= ((OPJ_UINT32)-5)) { |
| 33 + return OPJ_FALSE; |
| 34 + } |
| 35 + mr += 5; |
| 36 + |
| 37 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_v4_t) < mr) { |
| 38 + return OPJ_FALSE; |
| 39 + } |
| 40 + h.wavelet = (opj_v4_t*) opj_aligned_malloc(mr * sizeof(opj_v4_t)); |
| 41 if (!h.wavelet) { |
| 42 /* FIXME event manager error callback */ |
| 43 return OPJ_FALSE; |
| 44 diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c |
| 45 index 108ce78..a119db1 100644 |
| 46 --- a/third_party/libopenjpeg20/t1.c |
| 47 +++ b/third_party/libopenjpeg20/t1.c |
| 48 @@ -1173,6 +1173,9 @@ static OPJ_BOOL opj_t1_allocate_buffers( |
| 49 if (!t1->encoder) { |
| 50 if(datasize > t1->datasize){ |
| 51 opj_aligned_free(t1->data); |
| 52 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < d
atasize) { |
| 53 + return OPJ_FALSE; |
| 54 + } |
| 55 t1->data = (OPJ_INT32*) opj_aligned_malloc(datasize * si
zeof(OPJ_INT32)); |
| 56 if(!t1->data){ |
| 57 /* FIXME event manager error callback */ |
| 58 @@ -1187,6 +1190,9 @@ static OPJ_BOOL opj_t1_allocate_buffers( |
| 59 |
| 60 if(flagssize > t1->flagssize){ |
| 61 opj_aligned_free(t1->flags); |
| 62 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_flag_t) < flagssiz
e) { |
| 63 + return OPJ_FALSE; |
| 64 + } |
| 65 t1->flags = (opj_flag_t*) opj_aligned_malloc(flagssize * sizeof(
opj_flag_t)); |
| 66 if(!t1->flags){ |
| 67 /* FIXME event manager error callback */ |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2218783002:
openjpeg: Prevent overflows when using opj_aligned_malloc() (Closed)
Base URL: https://pdfium.googlesource.com/pdfium.git@master