OLD | NEW |
(Empty) | |
| 1 diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c |
| 2 index a6648f6..350803a 100644 |
| 3 --- a/third_party/libopenjpeg20/jp2.c |
| 4 +++ b/third_party/libopenjpeg20/jp2.c |
| 5 @@ -990,7 +990,18 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_
color_t *color) |
| 6 assert( i == pcol ); // probably wrong? |
| 7 new_comps[i] = old_comps[cmp]; |
| 8 } |
| 9 - |
| 10 + /* Prevent integer overflow */ |
| 11 + if (old_comps[cmp].h == 0 || old_comps[cmp].w > UINT_MAX / sizeof(OPJ_I
NT32) / old_comps[cmp].h) { |
| 12 + for (j = 0; j < i; ++j) { |
| 13 + if (new_comps[j].data) { |
| 14 + opj_free(new_comps[j].data); |
| 15 + } |
| 16 + } |
| 17 + opj_free(new_comps); |
| 18 + new_comps = NULL; |
| 19 + return; |
| 20 + } |
| 21 + |
| 22 /* Palette mapping: */ |
| 23 new_comps[i].data = (OPJ_INT32*) |
| 24 opj_malloc(old_comps[cmp].w * old_comps[cmp].h *
sizeof(OPJ_INT32)); |
| 25 @@ -1011,14 +1022,26 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_j
p2_color_t *color) |
| 26 /* Palette mapping: */ |
| 27 cmp = cmap[i].cmp; pcol = cmap[i].pcol; |
| 28 src = old_comps[cmp].data; |
| 29 - assert( src ); |
| 30 + |
| 31 + /* Prevent null pointer access */ |
| 32 + if (!old_comps[cmp].data || !new_comps[i].data) { |
| 33 + for (j = 0; j < nr_channels; ++j) { |
| 34 + if (new_comps[j].data) { |
| 35 + opj_free(new_comps[j].data); |
| 36 + } |
| 37 + } |
| 38 + opj_free(new_comps); |
| 39 + new_comps = NULL; |
| 40 + return; |
| 41 + } |
| 42 + |
| 43 max = new_comps[i].w * new_comps[i].h; |
| 44 |
| 45 /* Direct use: */ |
| 46 if(cmap[i].mtyp == 0) { |
| 47 assert( cmp == 0 ); // probably wrong. |
| 48 dst = new_comps[i].data; |
| 49 - assert( dst ); |
| 50 + |
| 51 for(j = 0; j < max; ++j) { |
| 52 dst[j] = src[j]; |
| 53 } |
| 54 @@ -1026,7 +1049,7 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2
_color_t *color) |
| 55 else { |
| 56 assert( i == pcol ); // probably wrong? |
| 57 dst = new_comps[i].data; |
| 58 - assert( dst ); |
| 59 + |
| 60 for(j = 0; j < max; ++j) { |
| 61 /* The index */ |
| 62 if((k = src[j]) < 0) k = 0; else if(k > top_k) k = top_k; |
OLD | NEW |