File openjpeg2-CVE-2015-1239.patch of Package openjpeg2

Overview Repositories Revisions Requests Users Attributes Meta

File openjpeg2-CVE-2015-1239.patch of Package openjpeg2

diff --git a/src/lib/openjp2/opj_intmath.h b/src/lib/openjp2/opj_intmath.h
index dc89895..f0b3e51 100644
--- a/src/lib/openjp2/opj_intmath.h
+++ b/src/lib/openjp2/opj_intmath.h
@@ -81,6 +81,15 @@ static INLINE OPJ_UINT32 opj_uint_max(OPJ_UINT32  a, OPJ_UINT32  b) {
 	return (a > b) ? a : b;
 }
 
+/**
+ Get the saturated sum of two unsigned integers
+ @return Returns saturated sum of a+b
+ */
+static INLINE OPJ_UINT32 opj_uint_adds(OPJ_UINT32 a, OPJ_UINT32 b) {
+	OPJ_UINT64 sum = (OPJ_UINT64)a + (OPJ_UINT64)b;
+	return -(OPJ_UINT32)(sum >> 32) | (OPJ_UINT32)sum;
+}
+
 /**
 Clamp an integer inside an interval
 @return
diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c
index 7e900e6..e27930b 100644
--- a/src/lib/openjp2/pi.c
+++ b/src/lib/openjp2/pi.c
@@ -701,6 +701,9 @@ void opj_get_all_encoding_parameters(   const opj_image_t *p_image,
 	/* position in x and y of tile*/
 	OPJ_UINT32 p, q;
 
+	/* non-corrected (in regard to image offset) tile offset */
+	OPJ_UINT32 l_tx0, l_ty0;
+
 	/* preconditions in debug*/
 	assert(p_cp != 00);
 	assert(p_image != 00);
@@ -716,10 +719,12 @@ void opj_get_all_encoding_parameters(   const opj_image_t *p_image,
 	q = tileno / p_cp->tw;
 
 	/* here calculation of tx0, tx1, ty0, ty1, maxprec, l_dx and l_dy */
-	*p_tx0 = opj_int_max((OPJ_INT32)(p_cp->tx0 + p * p_cp->tdx), (OPJ_INT32)p_image->x0);
-	*p_tx1 = opj_int_min((OPJ_INT32)(p_cp->tx0 + (p + 1) * p_cp->tdx), (OPJ_INT32)p_image->x1);
-	*p_ty0 = opj_int_max((OPJ_INT32)(p_cp->ty0 + q * p_cp->tdy), (OPJ_INT32)p_image->y0);
-	*p_ty1 = opj_int_min((OPJ_INT32)(p_cp->ty0 + (q + 1) * p_cp->tdy), (OPJ_INT32)p_image->y1);
+	l_tx0 = p_cp->tx0 + p * p_cp->tdx; /* can't be greater than p_image->x1 so won't overflow */
+	*p_tx0 = (OPJ_INT32)opj_uint_max(l_tx0, p_image->x0);
+	*p_tx1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, p_cp->tdx), p_image->x1);
+	l_ty0 = p_cp->ty0 + q * p_cp->tdy; /* can't be greater than p_image->y1 so won't overflow */
+	*p_ty0 = (OPJ_INT32)opj_uint_max(l_ty0, p_image->y0);
+	*p_ty1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, p_cp->tdy), p_image->y1);
 
 	/* max precision and resolution is 0 (can only grow)*/
 	*p_max_prec = 0;
diff --git a/src/lib/openjp2/tcd.c b/src/lib/openjp2/tcd.c
index 79262fc..e779149 100644
--- a/src/lib/openjp2/tcd.c
+++ b/src/lib/openjp2/tcd.c
@@ -639,6 +639,7 @@ OPJ_BOOL FUNCTION (     opj_tcd_t *p_tcd,                        \
         OPJ_UINT32 l_pdx, l_pdy;                                    \
         OPJ_UINT32 l_gain;                                          \
         OPJ_INT32 l_x0b, l_y0b;                                     \
+	OPJ_UINT32 l_tx0, l_ty0;                                    \
         /* extent of precincts , top left, bottom right**/          \
         OPJ_INT32 l_tl_prc_x_start, l_tl_prc_y_start, l_br_prc_x_end, l_br_prc_y_end;                                                                                                                             \
         /* number of precinct for a resolution */                   \
@@ -665,10 +666,13 @@ OPJ_BOOL FUNCTION (     opj_tcd_t *p_tcd,                        \
         /*fprintf(stderr, "Tile coordinate = %d,%d\n", p, q);*/     \
                                                                     \
         /* 4 borders of the tile rescale on the image if necessary */                                                                                                                                             \
-        l_tile->x0 = opj_int_max((OPJ_INT32)(l_cp->tx0 + p * l_cp->tdx), (OPJ_INT32)l_image->x0);                                                                                                                                             \
-        l_tile->y0 = opj_int_max((OPJ_INT32)(l_cp->ty0 + q * l_cp->tdy), (OPJ_INT32)l_image->y0);                                                                                                                                             \
-        l_tile->x1 = opj_int_min((OPJ_INT32)(l_cp->tx0 + (p + 1) * l_cp->tdx), (OPJ_INT32)l_image->x1);                                                                                                                                       \
-        l_tile->y1 = opj_int_min((OPJ_INT32)(l_cp->ty0 + (q + 1) * l_cp->tdy), (OPJ_INT32)l_image->y1);                                                                                                                                       \
+	l_tx0 = l_cp->tx0 + p * l_cp->tdx; /* can't be greater than l_image->x1 so won't overflow */ \
+	l_tile->x0 = (OPJ_INT32)opj_uint_max(l_tx0, l_image->x0); \
+	l_tile->x1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, l_cp->tdx), l_image->x1); \
+	l_ty0 = l_cp->ty0 + q * l_cp->tdy; /* can't be greater than l_image->y1 so won't overflow */ \
+	l_tile->y0 = (OPJ_INT32)opj_uint_max(l_ty0, l_image->y0); \
+	l_tile->y1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, l_cp->tdy), l_image->y1); \
+\
         /* testcase 1888.pdf.asan.35.988 */ \
         if (l_tccp->numresolutions == 0) { \
             fprintf(stderr, "tiles require at least one resolution\n"); \

Places

File openjpeg2-CVE-2015-1239.patch of Package openjpeg2

Places