49 lines
1.8 KiB
Diff
49 lines
1.8 KiB
Diff
From 940100c28ae28931722290794889cf84a92c5f6f Mon Sep 17 00:00:00 2001
|
|
From: mayeut <mayeut@users.noreply.github.com>
|
|
Date: Sun, 6 Sep 2015 17:24:03 +0200
|
|
Subject: [PATCH] Fix potential use-after-free in opj_j2k_write_mco function
|
|
|
|
Fixes #563
|
|
---
|
|
src/lib/openjp2/j2k.c | 8 ++++----
|
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
|
|
index 19a48f5..d487d89 100644
|
|
--- a/src/lib/openjp2/j2k.c
|
|
+++ b/src/lib/openjp2/j2k.c
|
|
@@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
|
|
assert(p_stream != 00);
|
|
|
|
l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]);
|
|
- l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
|
|
-
|
|
+
|
|
l_mco_size = 5 + l_tcp->m_nb_mcc_records;
|
|
if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) {
|
|
|
|
@@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
|
|
p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data;
|
|
p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size;
|
|
}
|
|
+ l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
|
|
+
|
|
|
|
opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */
|
|
l_current_data += 2;
|
|
@@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
|
|
++l_current_data;
|
|
|
|
l_mcc_record = l_tcp->m_mcc_records;
|
|
- for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
|
|
+ for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
|
|
opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/
|
|
++l_current_data;
|
|
-
|
|
++l_mcc_record;
|
|
}
|
|
|
|
--
|
|
2.5.0
|
|
|