jpc_cs: reject all but JPC_COX_INS and JPC_COX_RFT

Fixes assertion failure JPC_NOMINALGAIN() which can be caused by a crafted JP2 file. Closes #50, #142
jasper-software · Oct 6, 2017 · a10536d · a10536d
1 parent 1a36ca3
commit a10536d
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/libjasper/jpc/jpc_cs.c b/src/libjasper/jpc/jpc_cs.c
@@ -795,6 +795,9 @@ static int jpc_cox_getcompparms(jpc_ms_t *ms, jpc_cstate_t *cstate,
 	if (compparms->numdlvls > 32) {
 		goto error;
 	}
+	if (compparms->qmfbid != JPC_COX_INS &&
+	    compparms->qmfbid != JPC_COX_RFT)
+		goto error;
 	compparms->numrlvls = compparms->numdlvls + 1;
 	if (compparms->numrlvls > JPC_MAXRLVLS) {
 		goto error;