Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix multiple potential vulnerabilities and bugs #1168

Merged
merged 8 commits into from Dec 7, 2018
+132 −27
Merged

Fix multiple potential vulnerabilities and bugs #1168

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c5bd64e
[MJ2] To avoid divisions by zero / undefined behaviour on shift
Yoha-test Nov 23, 2018
619e1b0
[JPWL] fix CVE-2018-16375
Yoha-test Nov 23, 2018
46822d0
[JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#…
Yoha-test Nov 23, 2018
c277159
[MJ2] Avoid index out of bounds access to pi->include[]
Yoha-test Nov 23, 2018
c58df14
[OPENJP2] change the way to compute *p_tx0, *p_tx1, *p_ty0, *p_ty1 in…
Yoha-test Nov 23, 2018
ce9583d
[JPWL] opj_compress: reorder checks related to code block dimensions…
Yoha-test Nov 23, 2018
bd88611
[JP3D] To avoid divisions by zero / undefined behaviour on shift (CV…
Yoha-test Nov 23, 2018
05be308
[JPWL] tgatoimage(): avoid excessive memory allocation attempt,
Yoha-test Nov 28, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Next Next commit
[MJ2] To avoid divisions by zero / undefined behaviour on shift 
Signed-off-by: Young_X <YangX92@hotmail.com>
  • Loading branch information
@Yoha-test
Yoha-test committed Nov 23, 2018
commit c5bd64ea146162967c29bd2af0cbb845ba3eaaaf
21 changes: 21 additions & 0 deletions src/lib/openmj2/pi.c
View file
Open in desktop
Expand Up @@ -224,6 +224,13 @@ static opj_bool pi_next_rpcl(opj_pi_iterator_t * pi)
try1 = int_ceildiv(pi->ty1, comp->dy << levelno);
rpx = res->pdx + levelno;
rpy = res->pdy + levelno;

/* To avoid divisions by zero / undefined behaviour on shift */
if (rpx >= 31 || ((comp->dx << rpx) >> rpx) != comp->dx ||
rpy >= 31 || ((comp->dy << rpy) >> rpy) != comp->dy) {
continue;
}

if (!((pi->y % (comp->dy << rpy) == 0) || ((pi->y == pi->ty0) &&
((try0 << levelno) % (1 << rpy))))) {
continue;
Expand Down Expand Up @@ -317,6 +324,13 @@ static opj_bool pi_next_pcrl(opj_pi_iterator_t * pi)
try1 = int_ceildiv(pi->ty1, comp->dy << levelno);
rpx = res->pdx + levelno;
rpy = res->pdy + levelno;

/* To avoid divisions by zero / undefined behaviour on shift */
if (rpx >= 31 || ((comp->dx << rpx) >> rpx) != comp->dx ||
rpy >= 31 || ((comp->dy << rpy) >> rpy) != comp->dy) {
continue;
}

if (!((pi->y % (comp->dy << rpy) == 0) || ((pi->y == pi->ty0) &&
((try0 << levelno) % (1 << rpy))))) {
continue;
Expand Down Expand Up @@ -408,6 +422,13 @@ static opj_bool pi_next_cprl(opj_pi_iterator_t * pi)
try1 = int_ceildiv(pi->ty1, comp->dy << levelno);
rpx = res->pdx + levelno;
rpy = res->pdy + levelno;

/* To avoid divisions by zero / undefined behaviour on shift */
if (rpx >= 31 || ((comp->dx << rpx) >> rpx) != comp->dx ||
rpy >= 31 || ((comp->dy << rpy) >> rpy) != comp->dy) {
continue;
}

if (!((pi->y % (comp->dy << rpy) == 0) || ((pi->y == pi->ty0) &&
((try0 << levelno) % (1 << rpy))))) {
continue;
Expand Down