7ab73c4add
* gnu/packages/patches/openjpeg-CVE-2015-6581.patch: New file. * gnu-system.am (dist_patch_DATA): Add it. * gnu/packages/image.scm (openjpeg, openjpeg-2.0)[source]: Add patch.
47 lines
2.2 KiB
Diff
47 lines
2.2 KiB
Diff
From 0fa5a17c98c4b8f9ee2286f4f0a50cf52a5fccb0 Mon Sep 17 00:00:00 2001
|
|
From: Matthieu Darbois <mayeut@users.noreply.github.com>
|
|
Date: Tue, 19 May 2015 21:57:27 +0000
|
|
Subject: [PATCH] [trunk] Correct potential double free on malloc failure in
|
|
opj_j2k_copy_default_tcp_and_create_tcp (fixes issue 492)
|
|
|
|
---
|
|
src/lib/openjp2/j2k.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
|
|
index 8c62a39..cbdd368 100644
|
|
--- a/src/lib/openjp2/j2k.c
|
|
+++ b/src/lib/openjp2/j2k.c
|
|
@@ -7365,6 +7365,12 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2
|
|
l_tcp->cod = 0;
|
|
l_tcp->ppt = 0;
|
|
l_tcp->ppt_data = 00;
|
|
+ /* Remove memory not owned by this tile in case of early error return. */
|
|
+ l_tcp->m_mct_decoding_matrix = 00;
|
|
+ l_tcp->m_nb_max_mct_records = 0;
|
|
+ l_tcp->m_mct_records = 00;
|
|
+ l_tcp->m_nb_max_mcc_records = 0;
|
|
+ l_tcp->m_mcc_records = 00;
|
|
/* Reconnect the tile-compo coding parameters pointer to the current tile coding parameters*/
|
|
l_tcp->tccps = l_current_tccp;
|
|
|
|
@@ -7402,6 +7408,8 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2
|
|
|
|
++l_src_mct_rec;
|
|
++l_dest_mct_rec;
|
|
+ /* Update with each pass to free exactly what has been allocated on early return. */
|
|
+ l_tcp->m_nb_max_mct_records += 1;
|
|
}
|
|
|
|
/* Get the mcc_record of the dflt_tile_cp and copy them into the current tile cp*/
|
|
@@ -7411,6 +7419,7 @@ static OPJ_BOOL opj_j2k_copy_default_tcp_and_create_tcd ( opj_j2k_t * p_j2
|
|
return OPJ_FALSE;
|
|
}
|
|
memcpy(l_tcp->m_mcc_records,l_default_tcp->m_mcc_records,l_mcc_records_size);
|
|
+ l_tcp->m_nb_max_mcc_records = l_default_tcp->m_nb_max_mcc_records;
|
|
|
|
/* Copy the mcc record data from dflt_tile_cp to the current tile*/
|
|
l_src_mcc_rec = l_default_tcp->m_mcc_records;
|
|
--
|
|
2.5.0
|
|
|