From efbfbbb723e100cfbcea287a30958bf678e83458 Mon Sep 17 00:00:00 2001 From: Ariadne Conill Date: Tue, 27 Apr 2021 09:37:40 -0600 Subject: [PATCH] opj_{compress,decompress,dump}: fix possible buffer overflows in path manipulation functions --- src/bin/jp2/opj_compress.c | 12 ++++++------ src/bin/jp2/opj_decompress.c | 13 ++++++------- src/bin/jp2/opj_dump.c | 14 +++++++------- 3 files changed, 19 insertions(+), 20 deletions(-) diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c index 6827484..d8f894c 100644 --- a/src/bin/jp2/opj_compress.c +++ b/src/bin/jp2/opj_compress.c @@ -543,8 +543,8 @@ static char * get_file_name(char *name) static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, opj_cparameters_t *parameters) { - char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN], - outfilename[OPJ_PATH_LEN], temp_ofname[OPJ_PATH_LEN]; + char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN * 2], + outfilename[OPJ_PATH_LEN * 2], temp_ofname[OPJ_PATH_LEN]; char *temp_p, temp1[OPJ_PATH_LEN] = ""; strcpy(image_filename, dirptr->filename[imageno]); @@ -553,7 +553,7 @@ static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, if (parameters->decod_format == -1) { return 1; } - sprintf(infilename, "%s/%s", img_fol->imgdirpath, image_filename); + snprintf(infilename, OPJ_PATH_LEN * 2, "%s/%s", img_fol->imgdirpath, image_filename); if (opj_strcpy_s(parameters->infile, sizeof(parameters->infile), infilename) != 0) { return 1; @@ -566,7 +566,7 @@ static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, sprintf(temp1, ".%s", temp_p); } if (img_fol->set_out_format == 1) { - sprintf(outfilename, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, + snprintf(outfilename, OPJ_PATH_LEN * 2, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, img_fol->out_format); if (opj_strcpy_s(parameters->outfile, sizeof(parameters->outfile), outfilename) != 0) { @@ -1910,9 +1910,9 @@ int main(int argc, char **argv) num_images = get_num_images(img_fol.imgdirpath); dirptr = (dircnt_t*)malloc(sizeof(dircnt_t)); if (dirptr) { - dirptr->filename_buf = (char*)malloc(num_images * OPJ_PATH_LEN * sizeof( + dirptr->filename_buf = (char*)calloc(num_images, OPJ_PATH_LEN * sizeof( char)); /* Stores at max 10 image file names*/ - dirptr->filename = (char**) malloc(num_images * sizeof(char*)); + dirptr->filename = (char**) calloc(num_images, sizeof(char*)); if (!dirptr->filename_buf) { ret = 0; goto fin; diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c index 2634907..e54e54f 100644 --- a/src/bin/jp2/opj_decompress.c +++ b/src/bin/jp2/opj_decompress.c @@ -455,13 +455,13 @@ const char* path_separator = "/"; char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, opj_decompress_parameters *parameters) { - char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN], - outfilename[OPJ_PATH_LEN], temp_ofname[OPJ_PATH_LEN]; + char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN * 2], + outfilename[OPJ_PATH_LEN * 2], temp_ofname[OPJ_PATH_LEN]; char *temp_p, temp1[OPJ_PATH_LEN] = ""; strcpy(image_filename, dirptr->filename[imageno]); fprintf(stderr, "File Number %d \"%s\"\n", imageno, image_filename); - sprintf(infilename, "%s%s%s", img_fol->imgdirpath, path_separator, + snprintf(infilename, OPJ_PATH_LEN * 2, "%s%s%s", img_fol->imgdirpath, path_separator, image_filename); parameters->decod_format = infile_format(infilename); if (parameters->decod_format == -1) { @@ -479,7 +479,7 @@ char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, sprintf(temp1, ".%s", temp_p); } if (img_fol->set_out_format == 1) { - sprintf(outfilename, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, + snprintf(outfilename, OPJ_PATH_LEN * 2, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, img_fol->out_format); if (opj_strcpy_s(parameters->outfile, sizeof(parameters->outfile), outfilename) != 0) { @@ -1357,14 +1357,13 @@ int main(int argc, char **argv) return EXIT_FAILURE; } /* Stores at max 10 image file names */ - dirptr->filename_buf = (char*)malloc(sizeof(char) * - (size_t)num_images * OPJ_PATH_LEN); + dirptr->filename_buf = calloc((size_t) num_images, sizeof(char) * OPJ_PATH_LEN); if (!dirptr->filename_buf) { failed = 1; goto fin; } - dirptr->filename = (char**) malloc((size_t)num_images * sizeof(char*)); + dirptr->filename = (char**) calloc((size_t) num_images, sizeof(char*)); if (!dirptr->filename) { failed = 1; diff --git a/src/bin/jp2/opj_dump.c b/src/bin/jp2/opj_dump.c index 6e15fee..4e19c61 100644 --- a/src/bin/jp2/opj_dump.c +++ b/src/bin/jp2/opj_dump.c @@ -201,8 +201,8 @@ static int get_file_format(const char *filename) static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, opj_dparameters_t *parameters) { - char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN], - outfilename[OPJ_PATH_LEN], temp_ofname[OPJ_PATH_LEN]; + char image_filename[OPJ_PATH_LEN], infilename[OPJ_PATH_LEN * 2], + outfilename[OPJ_PATH_LEN * 2], temp_ofname[OPJ_PATH_LEN]; char *temp_p, temp1[OPJ_PATH_LEN] = ""; strcpy(image_filename, dirptr->filename[imageno]); @@ -211,7 +211,7 @@ static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, if (parameters->decod_format == -1) { return 1; } - sprintf(infilename, "%s/%s", img_fol->imgdirpath, image_filename); + snprintf(infilename, OPJ_PATH_LEN * 2, "%s/%s", img_fol->imgdirpath, image_filename); if (opj_strcpy_s(parameters->infile, sizeof(parameters->infile), infilename) != 0) { return 1; @@ -224,7 +224,7 @@ static char get_next_file(int imageno, dircnt_t *dirptr, img_fol_t *img_fol, sprintf(temp1, ".%s", temp_p); } if (img_fol->set_out_format == 1) { - sprintf(outfilename, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, + snprintf(outfilename, OPJ_PATH_LEN * 2, "%s/%s.%s", img_fol->imgdirpath, temp_ofname, img_fol->out_format); if (opj_strcpy_s(parameters->outfile, sizeof(parameters->outfile), outfilename) != 0) { @@ -457,7 +457,7 @@ int main(int argc, char *argv[]) opj_codestream_info_v2_t* cstr_info = NULL; opj_codestream_index_t* cstr_index = NULL; - OPJ_INT32 num_images, imageno; + int num_images, imageno; img_fol_t img_fol; dircnt_t *dirptr = NULL; @@ -486,13 +486,13 @@ int main(int argc, char *argv[]) if (!dirptr) { return EXIT_FAILURE; } - dirptr->filename_buf = (char*)malloc((size_t)num_images * OPJ_PATH_LEN * sizeof( + dirptr->filename_buf = (char*) calloc((size_t) num_images, OPJ_PATH_LEN * sizeof( char)); /* Stores at max 10 image file names*/ if (!dirptr->filename_buf) { free(dirptr); return EXIT_FAILURE; } - dirptr->filename = (char**) malloc((size_t)num_images * sizeof(char*)); + dirptr->filename = (char**) calloc((size_t) num_images, sizeof(char*)); if (!dirptr->filename) { goto fails; -- 2.31.1