Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:GA
openjpeg2
openjpeg2-CVE-2017-14039.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openjpeg2-CVE-2017-14039.patch of Package openjpeg2
diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c index 7c6d0f7..f6a6976 100644 --- a/src/lib/openjp2/j2k.c +++ b/src/lib/openjp2/j2k.c @@ -765,6 +765,7 @@ static OPJ_BOOL opj_j2k_write_tlm( opj_j2k_t *p_j2k, */ static OPJ_BOOL opj_j2k_write_sot( opj_j2k_t *p_j2k, OPJ_BYTE * p_data, + OPJ_UINT32 p_total_data_size, OPJ_UINT32 * p_data_written, const opj_stream_private_t *p_stream, opj_event_mgr_t * p_manager ); @@ -3908,6 +3909,7 @@ OPJ_BOOL opj_j2k_write_tlm( opj_j2k_t *p_j2k, OPJ_BOOL opj_j2k_write_sot( opj_j2k_t *p_j2k, OPJ_BYTE * p_data, + OPJ_UINT32 p_total_data_size, OPJ_UINT32 * p_data_written, const opj_stream_private_t *p_stream, opj_event_mgr_t * p_manager @@ -3918,6 +3920,12 @@ OPJ_BOOL opj_j2k_write_sot( opj_j2k_t *p_j2k, assert(p_manager != 00); assert(p_stream != 00); + if (p_total_data_size < 12) { + opj_event_msg(p_manager, EVT_ERROR, + "Not enough bytes in output buffer to write SOT marker\n"); + return OPJ_FALSE; + } + opj_write_bytes(p_data,J2K_MS_SOT,2); /* SOT */ p_data += 2; @@ -4226,6 +4234,12 @@ OPJ_BOOL opj_j2k_write_sod( opj_j2k_t *p_j2k, assert(p_manager != 00); assert(p_stream != 00); + if (p_total_data_size < 4) { + opj_event_msg(p_manager, EVT_ERROR, + "Not enough bytes in output buffer to write SOD marker\n"); + return OPJ_FALSE; + } + opj_write_bytes(p_data,J2K_MS_SOD,2); /* SOD */ p_data += 2; @@ -9975,7 +9989,7 @@ OPJ_BOOL opj_j2k_write_first_tile_part (opj_j2k_t *p_j2k, l_current_nb_bytes_written = 0; l_begin_data = p_data; - if (! opj_j2k_write_sot(p_j2k,p_data,&l_current_nb_bytes_written,p_stream,p_manager)) + if (! opj_j2k_write_sot(p_j2k,p_data,p_total_data_size,&l_current_nb_bytes_written,p_stream,p_manager)) { return OPJ_FALSE; } @@ -10063,7 +10077,7 @@ OPJ_BOOL opj_j2k_write_all_tile_parts( opj_j2k_t *p_j2k, l_part_tile_size = 0; l_begin_data = p_data; - if (! opj_j2k_write_sot(p_j2k,p_data,&l_current_nb_bytes_written,p_stream,p_manager)) { + if (! opj_j2k_write_sot(p_j2k,p_data,p_total_data_size,&l_current_nb_bytes_written,p_stream,p_manager)) { return OPJ_FALSE; } @@ -10103,7 +10117,7 @@ OPJ_BOOL opj_j2k_write_all_tile_parts( opj_j2k_t *p_j2k, l_part_tile_size = 0; l_begin_data = p_data; - if (! opj_j2k_write_sot(p_j2k,p_data,&l_current_nb_bytes_written,p_stream,p_manager)) { + if (! opj_j2k_write_sot(p_j2k,p_data,p_total_data_size,&l_current_nb_bytes_written,p_stream,p_manager)) { return OPJ_FALSE; } diff --git a/src/lib/openjp2/t2.c b/src/lib/openjp2/t2.c index 37f9814..3614a9f 100644 --- a/src/lib/openjp2/t2.c +++ b/src/lib/openjp2/t2.c @@ -562,6 +562,10 @@ OPJ_BOOL opj_t2_encode_packet( OPJ_UINT32 tileno, /* <SOP 0xff91> */ if (tcp->csty & J2K_CP_CSTY_SOP) { + if (length < 6) { + return OPJ_FALSE; + } + c[0] = 255; c[1] = 145; c[2] = 0; @@ -704,6 +708,10 @@ OPJ_BOOL opj_t2_encode_packet( OPJ_UINT32 tileno, /* <EPH 0xff92> */ if (tcp->csty & J2K_CP_CSTY_EPH) { + if (length < 2) { + return OPJ_FALSE; + } + c[0] = 255; c[1] = 146; c += 2;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor