52 lines
1.7 KiB
Diff
52 lines
1.7 KiB
Diff
diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c
|
|
index 8dc2b977f..3e23bc363 100644
|
|
--- a/third_party/libopenjpeg20/jp2.c
|
|
+++ b/third_party/libopenjpeg20/jp2.c
|
|
@@ -1058,6 +1058,14 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
|
|
}
|
|
|
|
old_comps = image->comps;
|
|
+ /* Overflow check: prevent integer overflow */
|
|
+ for (i = 0; i < nr_channels; ++i) {
|
|
+ cmp = cmap[i].cmp;
|
|
+ if (old_comps[cmp].h == 0 || old_comps[cmp].w > ((OPJ_UINT32)-1) / sizeof(OPJ_INT32) / old_comps[cmp].h) {
|
|
+ return OPJ_FALSE;
|
|
+ }
|
|
+ }
|
|
+
|
|
new_comps = (opj_image_comp_t*)
|
|
opj_malloc(nr_channels * sizeof(opj_image_comp_t));
|
|
if (!new_comps) {
|
|
@@ -1102,20 +1110,26 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
|
|
cmp = cmap[i].cmp;
|
|
pcol = cmap[i].pcol;
|
|
src = old_comps[cmp].data;
|
|
- assert(src); /* verified above */
|
|
+ dst = new_comps[i].data;
|
|
max = new_comps[i].w * new_comps[i].h;
|
|
|
|
+ /* Prevent null pointer access */
|
|
+ if (!src || !dst) {
|
|
+ for (j = 0; j < nr_channels; ++j) {
|
|
+ opj_free(new_comps[j].data);
|
|
+ }
|
|
+ opj_free(new_comps);
|
|
+ new_comps = NULL;
|
|
+ return OPJ_FALSE;
|
|
+ }
|
|
+
|
|
/* Direct use: */
|
|
if (cmap[i].mtyp == 0) {
|
|
- dst = new_comps[i].data;
|
|
- assert(dst);
|
|
for (j = 0; j < max; ++j) {
|
|
dst[j] = src[j];
|
|
}
|
|
} else {
|
|
assert( i == pcol ); // probably wrong?
|
|
- dst = new_comps[i].data;
|
|
- assert(dst);
|
|
for (j = 0; j < max; ++j) {
|
|
/* The index */
|
|
if ((k = src[j]) < 0) {
|