Skip to content

Commit

Permalink
Fixed bugs due to uninitialized data in the JP2 decoder.
Browse files Browse the repository at this point in the history 
Also, added some comments marking I/O stream interfaces that probably
need to be changed (in the long term) to fix integer overflow problems.
  • Loading branch information
@mdadams
mdadams committed Mar 4, 2017
1 parent 7692d6d commit e96fc4f
Show file tree
Hide file tree
Showing 2 changed files with 48 additions and 14 deletions.
18 changes: 18 additions & 0 deletions src/libjasper/base/jas_stream.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -664,6 +664,7 @@ int jas_stream_ungetc(jas_stream_t *stream, int c)
return 0;
}

/* FIXME integral type */
int jas_stream_read(jas_stream_t *stream, void *buf, int cnt)
{
int n;
Expand All @@ -690,6 +691,7 @@ int jas_stream_read(jas_stream_t *stream, void *buf, int cnt)
return n;
}

/* FIXME integral type */
int jas_stream_write(jas_stream_t *stream, const void *buf, int cnt)
{
int n;
Expand Down Expand Up @@ -742,6 +744,7 @@ int jas_stream_puts(jas_stream_t *stream, const char *s)
return 0;
}

/* FIXME integral type */
char *jas_stream_gets(jas_stream_t *stream, char *buf, int bufsize)
{
int c;
Expand All @@ -765,6 +768,7 @@ char *jas_stream_gets(jas_stream_t *stream, char *buf, int bufsize)
return buf;
}

/* FIXME integral type */
int jas_stream_gobble(jas_stream_t *stream, int n)
{
int m;
Expand All @@ -783,6 +787,7 @@ int jas_stream_gobble(jas_stream_t *stream, int n)
return n;
}

/* FIXME integral type */
int jas_stream_pad(jas_stream_t *stream, int n, int c)
{
int m;
Expand Down Expand Up @@ -885,6 +890,7 @@ long jas_stream_tell(jas_stream_t *stream)
* Buffer initialization code.
\******************************************************************************/

/* FIXME integral type */
static void jas_stream_initbuf(jas_stream_t *stream, int bufmode, char *buf,
int bufsize)
{
Expand Down Expand Up @@ -1060,6 +1066,7 @@ static int jas_strtoopenmode(const char *s)
return openmode;
}

/* FIXME integral type */
int jas_stream_copy(jas_stream_t *out, jas_stream_t *in, int n)
{
int all;
Expand All @@ -1085,6 +1092,7 @@ int jas_stream_copy(jas_stream_t *out, jas_stream_t *in, int n)
return 0;
}

/* FIXME integral type */
long jas_stream_setrwcount(jas_stream_t *stream, long rwcnt)
{
int old;
Expand All @@ -1094,6 +1102,7 @@ long jas_stream_setrwcount(jas_stream_t *stream, long rwcnt)
return old;
}

/* FIXME integral type */
int jas_stream_display(jas_stream_t *stream, FILE *fp, int n)
{
unsigned char buf[16];
Expand Down Expand Up @@ -1168,6 +1177,7 @@ long jas_stream_length(jas_stream_t *stream)
* Memory stream object.
\******************************************************************************/

/* FIXME integral type */
static int mem_read(jas_stream_obj_t *obj, char *buf, int cnt)
{
ssize_t n;
Expand Down Expand Up @@ -1209,6 +1219,7 @@ static int mem_resize(jas_stream_memobj_t *m, size_t bufsize)
return 0;
}

/* FIXME integral type */
static int mem_write(jas_stream_obj_t *obj, char *buf, int cnt)
{
size_t n;
Expand Down Expand Up @@ -1264,6 +1275,7 @@ static int mem_write(jas_stream_obj_t *obj, char *buf, int cnt)
return ret;
}

/* FIXME integral type */
static long mem_seek(jas_stream_obj_t *obj, long offset, int origin)
{
jas_stream_memobj_t *m = (jas_stream_memobj_t *)obj;
Expand Down Expand Up @@ -1310,6 +1322,7 @@ static int mem_close(jas_stream_obj_t *obj)
* File stream object.
\******************************************************************************/

/* FIXME integral type */
static int file_read(jas_stream_obj_t *obj, char *buf, int cnt)
{
jas_stream_fileobj_t *fileobj;
Expand All @@ -1318,6 +1331,7 @@ static int file_read(jas_stream_obj_t *obj, char *buf, int cnt)
return read(fileobj->fd, buf, cnt);
}

/* FIXME integral type */
static int file_write(jas_stream_obj_t *obj, char *buf, int cnt)
{
jas_stream_fileobj_t *fileobj;
Expand All @@ -1326,6 +1340,7 @@ static int file_write(jas_stream_obj_t *obj, char *buf, int cnt)
return write(fileobj->fd, buf, cnt);
}

/* FIXME integral type */
static long file_seek(jas_stream_obj_t *obj, long offset, int origin)
{
jas_stream_fileobj_t *fileobj;
Expand All @@ -1352,6 +1367,7 @@ static int file_close(jas_stream_obj_t *obj)
* Stdio file stream object.
\******************************************************************************/

/* FIXME integral type */
static int sfile_read(jas_stream_obj_t *obj, char *buf, int cnt)
{
FILE *fp;
Expand All @@ -1367,6 +1383,7 @@ static int sfile_read(jas_stream_obj_t *obj, char *buf, int cnt)
return result;
}

/* FIXME integral type */
static int sfile_write(jas_stream_obj_t *obj, char *buf, int cnt)
{
FILE *fp;
Expand All @@ -1377,6 +1394,7 @@ static int sfile_write(jas_stream_obj_t *obj, char *buf, int cnt)
return (n != JAS_CAST(size_t, cnt)) ? (-1) : cnt;
}

/* FIXME integral type */
static long sfile_seek(jas_stream_obj_t *obj, long offset, int origin)
{
FILE *fp;
Expand Down
44 changes: 30 additions & 14 deletions src/libjasper/jp2/jp2_cod.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -183,15 +183,28 @@ jp2_boxinfo_t jp2_boxinfo_unk = {
* Box constructor.
\******************************************************************************/

jp2_box_t *jp2_box_create(int type)
jp2_box_t *jp2_box_create0()
{
jp2_box_t *box;
jp2_boxinfo_t *boxinfo;

if (!(box = jas_malloc(sizeof(jp2_box_t)))) {
return 0;
}
memset(box, 0, sizeof(jp2_box_t));
box->type = 0;
box->len = 0;
// Mark the box data as never having been constructed
// so that we will not errantly attempt to destroy it later.
box->ops = &jp2_boxinfo_unk.ops;
return box;
}

jp2_box_t *jp2_box_create(int type)
{
jp2_box_t *box;
jp2_boxinfo_t *boxinfo;
if (!(box = jp2_box_create0())) {
return 0;
}
box->type = type;
box->len = 0;
if (!(boxinfo = jp2_boxinfolookup(type))) {
Expand Down Expand Up @@ -248,25 +261,22 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
box = 0;
tmpstream = 0;

if (!(box = jas_malloc(sizeof(jp2_box_t)))) {
if (!(box = jp2_box_create0())) {
goto error;
}

// Mark the box data as never having been constructed
// so that we will not errantly attempt to destroy it later.
box->ops = &jp2_boxinfo_unk.ops;

if (jp2_getuint32(in, &len) || jp2_getuint32(in, &box->type)) {
goto error;
}
boxinfo = jp2_boxinfolookup(box->type);
box->info = boxinfo;
box->len = len;
JAS_DBGLOG(10, (
"preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
"preliminary processing of JP2 box: "
"type=%c%s%c (0x%08x); length=%"PRIuFAST32"\n",
'"', boxinfo->name, '"', box->type, box->len
));
if (box->len == 1) {
JAS_DBGLOG(10, ("big length\n"));
if (jp2_getuint64(in, &extlen)) {
goto error;
}
Expand Down Expand Up @@ -382,6 +392,7 @@ static int jp2_bpcc_getdata(jp2_box_t *box, jas_stream_t *in)
{
jp2_bpcc_t *bpcc = &box->data.bpcc;
unsigned int i;
bpcc->bpcs = 0;
bpcc->numcmpts = box->datalen;
if (!(bpcc->bpcs = jas_alloc2(bpcc->numcmpts, sizeof(uint_fast8_t)))) {
return -1;
Expand Down Expand Up @@ -462,6 +473,7 @@ static int jp2_cdef_getdata(jp2_box_t *box, jas_stream_t *in)
jp2_cdef_t *cdef = &box->data.cdef;
jp2_cdefchan_t *chan;
unsigned int channo;
cdef->ents = 0;
if (jp2_getuint16(in, &cdef->numchans)) {
return -1;
}
Expand Down Expand Up @@ -518,7 +530,9 @@ int jp2_box_put(jp2_box_t *box, jas_stream_t *out)
}

if (dataflag) {
if (jas_stream_copy(out, tmpstream, box->len - JP2_BOX_HDRLEN(false))) {
if (jas_stream_copy(out, tmpstream, box->len -
JP2_BOX_HDRLEN(false))) {
jas_eprintf("cannot copy box data\n");
goto error;
}
jas_stream_close(tmpstream);
Expand Down Expand Up @@ -777,6 +791,7 @@ static int jp2_cmap_getdata(jp2_box_t *box, jas_stream_t *in)
jp2_cmap_t *cmap = &box->data.cmap;
jp2_cmapent_t *ent;
unsigned int i;
cmap->ents = 0;

cmap->numchans = (box->datalen) / 4;
if (!(cmap->ents = jas_alloc2(cmap->numchans, sizeof(jp2_cmapent_t)))) {
Expand Down Expand Up @@ -835,6 +850,7 @@ static int jp2_pclr_getdata(jp2_box_t *box, jas_stream_t *in)
int_fast32_t x;

pclr->lutdata = 0;
pclr->bpc = 0;

if (jp2_getuint16(in, &pclr->numlutents) ||
jp2_getuint8(in, &pclr->numchans)) {
Expand Down Expand Up @@ -869,9 +885,9 @@ static int jp2_pclr_putdata(jp2_box_t *box, jas_stream_t *out)
#if 0
jp2_pclr_t *pclr = &box->data.pclr;
#endif
/* Eliminate warning about unused variable. */
box = 0;
out = 0;
/* Eliminate warning about unused variable. */
box = 0;
out = 0;
return -1;
}

Expand Down

0 comments on commit e96fc4f

Please sign in to comment.