36 lines
1023 B
Diff
36 lines
1023 B
Diff
|
From 409907d89878222cf9dea80f0add8f73e9383834 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Mehdi Sabwat <mehdisabwat@gmail.com>
|
||
|
|
Date: Fri, 7 May 2021 01:50:37 +0200
|
||
|
|
Subject: [PATCH] fix heap buffer overflow #1347
|
||
|
|
|
||
|
|
---
|
||
|
|
src/bin/common/color.c | 9 ++++++---
|
||
|
|
1 file changed, 6 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/bin/common/color.c b/src/bin/common/color.c
|
||
|
|
index 27f15f1..935fa44 100644
|
||
|
|
--- a/src/bin/common/color.c
|
||
|
|
+++ b/src/bin/common/color.c
|
||
|
|
@@ -368,12 +368,15 @@ static void sycc420_to_rgb(opj_image_t *img)
|
||
|
|
|
||
|
|
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
|
||
|
|
|
||
|
|
- ++y;
|
||
|
|
+ if (*y != img->comps[0].data[loopmaxh])
|
||
|
|
+ ++y;
|
||
|
|
++r;
|
||
|
|
++g;
|
||
|
|
++b;
|
||
|
|
- ++cb;
|
||
|
|
- ++cr;
|
||
|
|
+ if (*cb != img->comps[1].data[loopmaxh])
|
||
|
|
+ ++cb;
|
||
|
|
+ if (*cr != img->comps[2].data[loopmaxh])
|
||
|
|
+ ++cr;
|
||
|
|
}
|
||
|
|
if (j < maxw) {
|
||
|
|
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
|
||
|
|
--
|
||
|
|
2.31.1
|
||
|
|
|