Skip to content

Commit 940100c

Browse files
committed
Fix potential use-after-free in opj_j2k_write_mco function
Fixes #563
1 parent c31fb68 commit 940100c

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

Diff for: src/lib/openjp2/j2k.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -5559,8 +5559,7 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
55595559
assert(p_stream != 00);
55605560

55615561
l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]);
5562-
l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
5563-
5562+
55645563
l_mco_size = 5 + l_tcp->m_nb_mcc_records;
55655564
if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) {
55665565

@@ -5575,6 +5574,8 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
55755574
p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data;
55765575
p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size;
55775576
}
5577+
l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data;
5578+
55785579

55795580
opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */
55805581
l_current_data += 2;
@@ -5586,10 +5587,9 @@ static OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k,
55865587
++l_current_data;
55875588

55885589
l_mcc_record = l_tcp->m_mcc_records;
5589-
for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
5590+
for (i=0;i<l_tcp->m_nb_mcc_records;++i) {
55905591
opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/
55915592
++l_current_data;
5592-
55935593
++l_mcc_record;
55945594
}
55955595

0 commit comments

Comments
 (0)