Update openjpeg to r2908

core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c

 /*
  * The copyright in this software is being made available under the 2-clauses 
  * BSD License, included below. This software may be subject to other third 
  * party and contributor rights, including patent rights, and no such rights
  * are granted under this license.
  *
  * Copyright (c) 2002-2014, Universite catholique de Louvain (UCL), Belgium
  * Copyright (c) 2002-2014, Professor Benoit Macq
  * Copyright (c) 2001-2003, David Janssens
  * Copyright (c) 2002-2003, Yannick Verschueren
@@ skipping 2397 matching lines @@
                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
 
         /* Make sure room is sufficient */
         if (p_header_size < 5) {
                 opj_event_msg(p_manager, EVT_ERROR, "Error reading COD marker\n");
                 return OPJ_FALSE;
         }
 
         opj_read_bytes(p_header_data,&l_tcp->csty,1);           /* Scod */
         ++p_header_data;
+        /* Make sure we know how to decode this */
+        if ((l_tcp->csty & ~(OPJ_UINT32)(J2K_CP_CSTY_PRT | J2K_CP_CSTY_SOP | J2K_CP_CSTY_EPH)) != 0U) {
+                opj_event_msg(p_manager, EVT_ERROR, "Unknown Scod value in COD marker\n");
+                return OPJ_FALSE;
+        }
         opj_read_bytes(p_header_data,&l_tmp,1);                         /* SGcod (A) */
         ++p_header_data;
         l_tcp->prg = (OPJ_PROG_ORDER) l_tmp;
+        /* Make sure progression order is valid */
+        if (l_tcp->prg > OPJ_CPRL ) {
+                opj_event_msg(p_manager, EVT_ERROR, "Unknown progression order in COD marker\n");
+                l_tcp->prg = OPJ_PROG_UNKNOWN;
+        }
         opj_read_bytes(p_header_data,&l_tcp->numlayers,2);      /* SGcod (B) */
         p_header_data+=2;
 
         /* If user didn't set a number layer to decode take the max specify in the codestream. */
         if      (l_cp->m_specific_param.m_dec.m_layer) {
                 l_tcp->num_layers_to_decode = l_cp->m_specific_param.m_dec.m_layer;
         }
         else {
                 l_tcp->num_layers_to_decode = l_tcp->numlayers;
         }
@@ skipping 1106 matching lines @@
 
         l_cp = &(p_j2k->m_cp);
         l_cp->ppm = 1;
 
         opj_read_bytes(p_header_data,&l_Z_ppm,1);               /* Z_ppm */
         ++p_header_data;
         --p_header_size;
 
         /* First PPM marker */
         if (l_Z_ppm == 0) {
+                if (l_cp->ppm_data != NULL) {
+                        opj_event_msg(p_manager, EVT_ERROR, "Zppm O already processed. Found twice.\n");
+                        opj_free(l_cp->ppm_data);
+                        l_cp->ppm_data = NULL;
+                        l_cp->ppm_buffer = NULL;
+                        l_cp->ppm = 0; /* do not use PPM */
+                        return OPJ_FALSE;
+                }
                 /* We need now at least the Nppm^0 element */
                 if (p_header_size < 4) {
                         opj_event_msg(p_manager, EVT_ERROR, "Error reading PPM marker\n");
                         return OPJ_FALSE;
                 }
 
                 opj_read_bytes(p_header_data,&l_N_ppm,4);               /* First N_ppm */
                 p_header_data+=4;
                 p_header_size-=4;
 
@@ skipping 77 matching lines @@
         while (l_remaining_data >= l_N_ppm) {
                 /* read a complete Ippm series*/
                 memcpy(l_cp->ppm_data_current, p_header_data, l_N_ppm);
                 p_header_size -= l_N_ppm;
                 p_header_data += l_N_ppm;
 
                 l_cp->ppm_data_read += l_N_ppm; /* Increase the number of data read*/
 
                 if (p_header_size)
                 {
+                        if (p_header_size < 4) {
+                                opj_free(l_cp->ppm_data);
+                                l_cp->ppm_data = NULL;
+                                l_cp->ppm_buffer = NULL;  /* TODO: no need for a new local variable: ppm_buffer and ppm_data are enough */
+                                l_cp->ppm_len = 0;
+                                l_cp->ppm = 0;
+                                opj_event_msg(p_manager, EVT_ERROR, "Error reading PPM marker\n");
+                                return OPJ_FALSE;
+                        }
                         opj_read_bytes(p_header_data,&l_N_ppm,4);               /* N_ppm^i */
                         p_header_data+=4;
                         p_header_size-=4;
                 }
                 else {
                         l_remaining_data = p_header_size;
                         break;
                 }
 
                 l_remaining_data = p_header_size;
@@ skipping 656 matching lines @@
             else {
                 /* MSD: case commented to support empty SOT marker (PHR data) */
             }
         }
 
         l_current_data = &(l_tcp->m_data);
         l_tile_len = &l_tcp->m_data_size;
 
         /* Patch to support new PHR data */
         if (p_j2k->m_specific_param.m_decoder.m_sot_length) {
+            /* If we are here, we'll try to read the data after allocation */
+            /* Check enough bytes left in stream before allocation */
+            if ((OPJ_OFF_T)p_j2k->m_specific_param.m_decoder.m_sot_length > opj_stream_get_number_byte_left(p_stream)) {
+                opj_event_msg(p_manager, EVT_ERROR, "Tile part length size inconsistent with stream length\n");
+                return OPJ_FALSE;
+            }
             if (! *l_current_data) {
                 /* LH: oddly enough, in this path, l_tile_len!=0.
                  * TODO: If this was consistant, we could simplify the code to only use realloc(), as realloc(0,...) default to malloc(0,...).
                  */
                 *l_current_data = (OPJ_BYTE*) opj_malloc(p_j2k->m_specific_param.m_decoder.m_sot_length);
             }
             else {
                 OPJ_BYTE *l_new_current_data = (OPJ_BYTE *) opj_realloc(*l_current_data, *l_tile_len + p_j2k->m_specific_param.m_decoder.m_sot_length);
                 if (! l_new_current_data) {
                         opj_free(*l_current_data);
@@ skipping 1780 matching lines @@
                                                     opj_image_t *image,
                                                     opj_event_mgr_t * p_manager)
 {
         OPJ_UINT32 i, j, tileno, numpocs_tile;
         opj_cp_t *cp = 00;
 
         if(!p_j2k || !parameters || ! image) {
                 return OPJ_FALSE;
         }
 
+        if ((parameters->numresolution <= 0) || (parameters->numresolution > OPJ_J2K_MAXRLVLS)) {
+            opj_event_msg(p_manager, EVT_ERROR, "Invalid number of resolutions : %d not in range [1,%d]\n", parameters->numresolution, OPJ_J2K_MAXRLVLS);
+            return OPJ_FALSE;
+        }
+
         /* keep a link to cp so that we can destroy it later in j2k_destroy_compress */
         cp = &(p_j2k->m_cp);
 
         /* set default values for cp */
         cp->tw = 1;
         cp->th = 1;
 
         /* FIXME ADE: to be removed once deprecated cp_cinema and cp_rsiz have been removed */
         if (parameters->rsiz == OPJ_PROFILE_NONE) { /* consider deprecated fields only if RSIZ has not been set */
             OPJ_BOOL deprecated_used = OPJ_FALSE;
@@ skipping 367 matching lines @@
                             tccp->m_dc_level_shift = l_dc_shift[i];
                     }
 
                     if (opj_j2k_setup_mct_encoding(tcp,image) == OPJ_FALSE) {
                         /* free will be handled by opj_j2k_destroy */
                                                                                                 opj_event_msg(p_manager, EVT_ERROR, "Failed to setup j2k mct encoding\n");
                         return OPJ_FALSE;
                     }
                 }
                 else {
-                    if(tcp->mct==1 && image->numcomps == 3) { // RGB->YCC MCT is enabled
+                    if(tcp->mct==1 && image->numcomps == 3) { /* RGB->YCC MCT is enabled */
                         if ((image->comps[0].dx != image->comps[1].dx) ||
                                 (image->comps[0].dx != image->comps[2].dx) ||
                                 (image->comps[0].dy != image->comps[1].dy) ||
                                 (image->comps[0].dy != image->comps[2].dy)) {
                             opj_event_msg(p_manager, EVT_WARNING, "Cannot perform MCT on components with different sizes. Disabling MCT.\n");
                             tcp->mct = 0;
                         }
                     }
                         for (i = 0; i < image->numcomps; i++) {
                                 opj_tccp_t *tccp = &tcp->tccps[i];
@@ skipping 467 matching lines @@
         /* STATE checking */
         /* make sure the state is at 0 */
         l_is_valid &= (p_j2k->m_specific_param.m_decoder.m_state == J2K_STATE_NONE);
 
         /* POINTER validation */
         /* make sure a p_j2k codec is present */
         l_is_valid &= (p_j2k->m_procedure_list != 00);
         /* make sure a validation list is present */
         l_is_valid &= (p_j2k->m_validation_list != 00);
 
+              /* ISO 15444-1:2004 states between 1 & 33 (0 -> 32) */
+              /* 33 (32) would always fail the 2 checks below (if a cast to 64bits was done) */
+              /* 32 (31) would always fail the 2 checks below (if a cast to 64bits was done) */
+        /* FIXME Shall we change OPJ_J2K_MAXRLVLS to 31 ? */
+        if ((p_j2k->m_cp.tcps->tccps->numresolutions <= 0) || (p_j2k->m_cp.tcps->tccps->numresolutions > 31)) {
+                opj_event_msg(p_manager, EVT_ERROR, "Number of resolutions is too high in comparison to the size of tiles\n");
+                return OPJ_FALSE;
+        }
+
         if ((p_j2k->m_cp.tdx) < (OPJ_UINT32) (1 << p_j2k->m_cp.tcps->tccps->numresolutions)) {
                 opj_event_msg(p_manager, EVT_ERROR, "Number of resolutions is too high in comparison to the size of tiles\n");
                 return OPJ_FALSE;
         }
 
         if ((p_j2k->m_cp.tdy) < (OPJ_UINT32) (1 << p_j2k->m_cp.tcps->tccps->numresolutions)) {
                 opj_event_msg(p_manager, EVT_ERROR, "Number of resolutions is too high in comparison to the size of tiles\n");
                 return OPJ_FALSE;
         }
 
@@ skipping 578 matching lines @@
 
                         /* Try to read 2 bytes (the marker size) from stream and copy them into the buffer */
                         if (opj_stream_read_data(p_stream,p_j2k->m_specific_param.m_decoder.m_header_data,2,p_manager) != 2) {
                                 opj_event_msg(p_manager, EVT_ERROR, "Stream too short\n");
                                 return OPJ_FALSE;
                         }
 
                         /* Read 2 bytes from the buffer as the marker size */
                         opj_read_bytes(p_j2k->m_specific_param.m_decoder.m_header_data,&l_marker_size,2);
 
+                        /* Check marker size (does not include marker ID but includes marker size) */
+                        if (l_marker_size < 2) {
+                                opj_event_msg(p_manager, EVT_ERROR, "Inconsistent marker size\n");
+                                return OPJ_FALSE;
+                        }
+
                         /* cf. https://code.google.com/p/openjpeg/issues/detail?id=226 */
                         if (l_current_marker == 0x8080 && opj_stream_get_number_byte_left(p_stream) == 0) {
                                 p_j2k->m_specific_param.m_decoder.m_state = J2K_STATE_NEOC;
                                 break;
                         }
 
                         /* Why this condition? FIXME */
                         if (p_j2k->m_specific_param.m_decoder.m_state & J2K_STATE_TPH){
                                 p_j2k->m_specific_param.m_decoder.m_sot_length -= (l_marker_size + 2);
                         }
                         l_marker_size -= 2; /* Subtract the size of the marker ID already read */
 
                         /* Get the marker handler from the marker ID */
                         l_marker_handler = opj_j2k_get_marker_handler(l_current_marker);
 
                         /* Check if the marker is known and if it is the right place to find it */
                         if (! (p_j2k->m_specific_param.m_decoder.m_state & l_marker_handler->states) ) {
                                 opj_event_msg(p_manager, EVT_ERROR, "Marker is not compliant with its position\n");
                                 return OPJ_FALSE;
                         }
 /* FIXME manage case of unknown marker as in the main header ? */
 
                         /* Check if the marker size is compatible with the header data size */
                         if (l_marker_size > p_j2k->m_specific_param.m_decoder.m_header_data_size) {
-                                OPJ_BYTE *new_header_data = (OPJ_BYTE *) opj_realloc(p_j2k->m_specific_param.m_decoder.m_header_data, l_marker_size);
+                                OPJ_BYTE *new_header_data = NULL;
+                                /* If we are here, this means we consider this marker as known & we will read it */
+                                /* Check enough bytes left in stream before allocation */
+                                if ((OPJ_OFF_T)l_marker_size >  opj_stream_get_number_byte_left(p_stream)) {
+                                        opj_event_msg(p_manager, EVT_ERROR, "Marker size inconsistent with stream length\n");
+                                        return OPJ_FALSE;
+                                }
+                                new_header_data = (OPJ_BYTE *) opj_realloc(p_j2k->m_specific_param.m_decoder.m_header_data, l_marker_size);
                                 if (! new_header_data) {
                                         opj_free(p_j2k->m_specific_param.m_decoder.m_header_data);
                                         p_j2k->m_specific_param.m_decoder.m_header_data = NULL;
                                         p_j2k->m_specific_param.m_decoder.m_header_data_size = 0;
                                         opj_event_msg(p_manager, EVT_ERROR, "Not enough memory to read header\n");
                                         return OPJ_FALSE;
                                 }
                                 p_j2k->m_specific_param.m_decoder.m_header_data = new_header_data;
                                 p_j2k->m_specific_param.m_decoder.m_header_data_size = l_marker_size;
                         }
@@ skipping 2750 matching lines @@
         }
         else {
                 if (! opj_j2k_post_write_tile(p_j2k,p_data,p_data_size,p_stream,p_manager)) {
                         opj_event_msg(p_manager, EVT_ERROR, "Error while opj_j2k_post_write_tile with tile index = %d\n", p_tile_index);
                         return OPJ_FALSE;
                 }
         }
 
         return OPJ_TRUE;
 }