1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
Index: libopenjpeg/jp2.c
===================================================================
--- libopenjpeg/jp2.c (revision 2028)
+++ libopenjpeg/jp2.c (revision 2029)
@@ -173,6 +173,10 @@
else if (box->length == 0) {
box->length = cio_numbytesleft(cio) + 8;
}
+ if (box->length < 0) {
+ opj_event_msg(cinfo, EVT_ERROR, "Integer overflow in box->length\n");
+ return OPJ_FALSE; // TODO: actually check jp2_read_boxhdr's return value
+ }
return OPJ_TRUE;
}
@@ -654,6 +658,7 @@
opj_event_msg(cinfo, EVT_ERROR, "Expected JP2H Marker\n");
return OPJ_FALSE;
}
+ if (box.length <= 8) return OPJ_FALSE;
cio_skip(cio, box.length - 8);
if(cio->bp >= cio->end) return OPJ_FALSE;
@@ -679,6 +684,7 @@
{
if( !jp2_read_colr(jp2, cio, &box, color))
{
+ if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8);
}
@@ -689,6 +695,7 @@
{
if( !jp2_read_cdef(jp2, cio, &box, color))
{
+ if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8);
}
@@ -699,6 +706,7 @@
{
if( !jp2_read_pclr(jp2, cio, &box, color))
{
+ if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8);
}
@@ -709,12 +717,14 @@
{
if( !jp2_read_cmap(jp2, cio, &box, color))
{
+ if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8);
}
if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE;
continue;
}
+ if (box.length <= 8) return OPJ_FALSE;
cio_seek(cio, box.init_pos + 8);
cio_skip(cio, box.length - 8);
if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE;
@@ -910,12 +920,14 @@
}
do {
if(JP2_JP2C != box.type) {
+ if (box.length <= 8) return OPJ_FALSE;
cio_skip(cio, box.length - 8);
if( jp2_read_boxhdr(cinfo, cio, &box) == OPJ_FALSE ) return OPJ_FALSE;
}
} while(JP2_JP2C != box.type);
*j2k_codestream_offset = cio_tell(cio);
+ if (box.length <= 8) return OPJ_FALSE;
*j2k_codestream_length = box.length - 8;
return OPJ_TRUE;
|