0005-bmp_read_rle4_data-avoid-potential-infinite-loop.patch 3.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586
  1. From 3aef207f90e937d4931daf6d411e092f76d82e66 Mon Sep 17 00:00:00 2001
  2. From: Young Xiao <YangX92@hotmail.com>
  3. Date: Sat, 16 Mar 2019 20:09:59 +0800
  4. Subject: [PATCH] bmp_read_rle4_data(): avoid potential infinite loop
  5. [Retrieved from:
  6. https://github.com/uclouvain/openjpeg/commit/3aef207f90e937d4931daf6d411e092f76d82e66]
  7. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
  8. ---
  9. src/bin/jp2/convertbmp.c | 32 ++++++++++++++++++++++++++------
  10. 1 file changed, 26 insertions(+), 6 deletions(-)
  11. diff --git a/src/bin/jp2/convertbmp.c b/src/bin/jp2/convertbmp.c
  12. index ec34f535b..2fc4e9bc4 100644
  13. --- a/src/bin/jp2/convertbmp.c
  14. +++ b/src/bin/jp2/convertbmp.c
  15. @@ -632,12 +632,18 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
  16. while (y < height) {
  17. int c = getc(IN);
  18. if (c == EOF) {
  19. - break;
  20. + return OPJ_FALSE;
  21. }
  22. if (c) { /* encoded mode */
  23. - int j;
  24. - OPJ_UINT8 c1 = (OPJ_UINT8)getc(IN);
  25. + int j, c1_int;
  26. + OPJ_UINT8 c1;
  27. +
  28. + c1_int = getc(IN);
  29. + if (c1_int == EOF) {
  30. + return OPJ_FALSE;
  31. + }
  32. + c1 = (OPJ_UINT8)c1_int;
  33. for (j = 0; (j < c) && (x < width) &&
  34. ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
  35. @@ -647,7 +653,7 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
  36. } else { /* absolute mode */
  37. c = getc(IN);
  38. if (c == EOF) {
  39. - break;
  40. + return OPJ_FALSE;
  41. }
  42. if (c == 0x00) { /* EOL */
  43. @@ -658,8 +664,14 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
  44. break;
  45. } else if (c == 0x02) { /* MOVE by dxdy */
  46. c = getc(IN);
  47. + if (c == EOF) {
  48. + return OPJ_FALSE;
  49. + }
  50. x += (OPJ_UINT32)c;
  51. c = getc(IN);
  52. + if (c == EOF) {
  53. + return OPJ_FALSE;
  54. + }
  55. y += (OPJ_UINT32)c;
  56. pix = pData + y * stride + x;
  57. } else { /* 03 .. 255 : absolute mode */
  58. @@ -669,13 +681,21 @@ static OPJ_BOOL bmp_read_rle4_data(FILE* IN, OPJ_UINT8* pData,
  59. for (j = 0; (j < c) && (x < width) &&
  60. ((OPJ_SIZE_T)pix < (OPJ_SIZE_T)beyond); j++, x++, pix++) {
  61. if ((j & 1) == 0) {
  62. - c1 = (OPJ_UINT8)getc(IN);
  63. + int c1_int;
  64. + c1_int = getc(IN);
  65. + if (c1_int == EOF) {
  66. + return OPJ_FALSE;
  67. + }
  68. + c1 = (OPJ_UINT8)c1_int;
  69. }
  70. *pix = (OPJ_UINT8)((j & 1) ? (c1 & 0x0fU) : ((c1 >> 4) & 0x0fU));
  71. written++;
  72. }
  73. if (((c & 3) == 1) || ((c & 3) == 2)) { /* skip padding byte */
  74. - getc(IN);
  75. + c = getc(IN);
  76. + if (c == EOF) {
  77. + return OPJ_FALSE;
  78. + }
  79. }
  80. }
  81. }