Skip to content

Commit

Permalink
jp2: convert: fix null pointer dereference
Browse files Browse the repository at this point in the history
Tile components in a JP2 image might have null data pointer by defining a
zero component size (for example using large horizontal or vertical
sampling periods). This null data pointer leads to null image component
data pointer, causing crash when dereferenced without != null check in
imagetopnm.

Add != null check.

This commit addresses #1152 (CVE-2018-18088).
  • Loading branch information
hlef committed Nov 7, 2018
1 parent 0bc90e4 commit cab352e
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions src/bin/jp2/convert.c
Original file line number Diff line number Diff line change
Expand Up @@ -2233,6 +2233,11 @@ int imagetopnm(opj_image_t * image, const char *outfile, int force_split)
opj_version(), wr, hr, max);

red = image->comps[compno].data;
if (!red) {
fclose(fdest);
continue;
}

adjustR =
(image->comps[compno].sgnd ? 1 << (image->comps[compno].prec - 1) : 0);

Expand Down

0 comments on commit cab352e

Please sign in to comment.