core/src/fxcodec/codec/fx_codec_jpx_opj.cpp - Issue 489703004: Bounds check before fixed-size memcmp() in CJPX_Decoder::Init().

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: core/src/fxcodec/codec/fx_codec_jpx_opj.cpp

Issue 489703004: Bounds check before fixed-size memcmp() in CJPX_Decoder::Init(). (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master

Patch Set: Created 6 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: core/src/fxcodec/codec/fx_codec_jpx_opj.cpp

diff --git a/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp b/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp

index 4494244410854eb4f86c30fc547747d932191ce4..1a7e541075c9b37826e07c676b05f7c2b208041e 100644

--- a/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp

+++ b/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp

@@ -596,7 +596,7 @@ FX_BOOL CJPX_Decoder::Init(const unsigned char* src_data, int src_size)

opj_set_default_decoder_parameters(&parameters);

parameters.decod_format = 0;

parameters.cod_format = 3;

- if(FXSYS_memcmp32(m_SrcData, "\x00\x00\x00\x0c\x6a\x50\x20\x20\x0d\x0a\x87\x0a", 12) == 0) {

+ if(m_SrcSize >= 12 && FXSYS_memcmp32(m_SrcData, "\x00\x00\x00\x0c\x6a\x50\x20\x20\x0d\x0a\x87\x0a", 12) == 0) {

jun_fang 2014/08/26 21:48:09 1. Define an array to save the string "\x00\x00\x0

l_codec = opj_create_decompress(OPJ_CODEC_JP2);

parameters.decod_format = 1;

} else {

« no previous file with comments | « no previous file | no next file » | no next file with comments »