jasper/jasper-CVE-2021-3272.patch
2021-01-28 09:12:50 +01:00

48 lines
1.7 KiB
Diff

From 49174ab592cdfa6f1a929a2ee3d4b4976f9459fd Mon Sep 17 00:00:00 2001
From: Michael Adams <mdadams@ece.uvic.ca>
Date: Tue, 19 Jan 2021 22:59:33 -0800
Subject: [PATCH] Fixes #259
---
src/libjasper/jp2/jp2_dec.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/src/libjasper/jp2/jp2_dec.c b/src/libjasper/jp2/jp2_dec.c
index 4acf004..60dee42 100644
--- a/src/libjasper/jp2/jp2_dec.c
+++ b/src/libjasper/jp2/jp2_dec.c
@@ -255,7 +255,7 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
with the data in the code stream? */
if ((samedtype && dec->ihdr->data.ihdr.bpc != JP2_DTYPETOBPC(dtype)) ||
(!samedtype && dec->ihdr->data.ihdr.bpc != JP2_IHDR_BPCNULL)) {
- jas_eprintf("warning: component data type mismatch\n");
+ jas_eprintf("warning: component data type mismatch (IHDR)\n");
}
/* Is the compression type supported? */
@@ -278,7 +278,7 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
++i) {
if (jas_image_cmptdtype(dec->image, i) !=
JP2_BPCTODTYPE(dec->bpcc->data.bpcc.bpcs[i])) {
- jas_eprintf("warning: component data type mismatch\n");
+ jas_eprintf("warning: component data type mismatch (BPCC)\n");
}
}
} else {
@@ -409,6 +409,14 @@ jas_image_t *jp2_decode(jas_stream_t *in, const char *optstr)
}
}
+ /* Ensure that the number of channels being used by the decoder
+ matches the number of image components. */
+ if (dec->numchans != jas_image_numcmpts(dec->image)) {
+ jas_eprintf("error: mismatch in number of components (%d != %d)\n",
+ dec->numchans, jas_image_numcmpts(dec->image));
+ goto error;
+ }
+
/* Mark all components as being of unknown type. */
for (i = 0; i < JAS_CAST(jas_uint, jas_image_numcmpts(dec->image)); ++i) {