64 lines
1.9 KiB
Diff
64 lines
1.9 KiB
Diff
From d4358fb62a01bd542146a1d25b8f6fd2a0b210fe Mon Sep 17 00:00:00 2001
|
|
From: Michael Vetter <jubalh@iodoru.org>
|
|
Date: Mon, 25 Mar 2019 12:20:26 +0100
|
|
Subject: [PATCH] Fix integer width in jpc_math
|
|
|
|
Fix denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.
|
|
|
|
Assigned CVE-2018-9055.
|
|
Fixes https://github.com/mdadams/jasper/issues/172.
|
|
|
|
Fix by Fridrich Strba <FStrba@suse.com>.
|
|
---
|
|
src/libjasper/jpc/jpc_math.c | 4 ++--
|
|
src/libjasper/jpc/jpc_math.h | 5 +++--
|
|
2 files changed, 5 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/libjasper/jpc/jpc_math.c b/src/libjasper/jpc/jpc_math.c
|
|
index 2b70844..1b18880 100644
|
|
--- a/src/libjasper/jpc/jpc_math.c
|
|
+++ b/src/libjasper/jpc/jpc_math.c
|
|
@@ -86,7 +86,7 @@
|
|
|
|
/* Calculate the integer quantity floor(log2(x)), where x is a positive
|
|
integer. */
|
|
-int jpc_floorlog2(int x)
|
|
+int jpc_floorlog2(int_fast32_t x)
|
|
{
|
|
int y;
|
|
|
|
@@ -105,7 +105,7 @@ int jpc_floorlog2(int x)
|
|
integer. */
|
|
/* This function is the basically the same as ceillog2(x), except that the
|
|
allowable range for x is slightly different. */
|
|
-int jpc_firstone(int x)
|
|
+int jpc_firstone(int_fast32_t x)
|
|
{
|
|
int n;
|
|
|
|
diff --git a/src/libjasper/jpc/jpc_math.h b/src/libjasper/jpc/jpc_math.h
|
|
index e8e0978..bd80d51 100644
|
|
--- a/src/libjasper/jpc/jpc_math.h
|
|
+++ b/src/libjasper/jpc/jpc_math.h
|
|
@@ -67,6 +67,7 @@
|
|
\******************************************************************************/
|
|
|
|
#include <assert.h>
|
|
+#include <stdint.h>
|
|
|
|
/******************************************************************************\
|
|
* Macros
|
|
@@ -90,10 +91,10 @@
|
|
|
|
/* Calculate the bit position of the first leading one in a nonnegative
|
|
integer. */
|
|
-int jpc_firstone(int x);
|
|
+int jpc_firstone(int_fast32_t x);
|
|
|
|
/* Calculate the integer quantity floor(log2(x)), where x is a positive
|
|
integer. */
|
|
-int jpc_floorlog2(int x);
|
|
+int jpc_floorlog2(int_fast32_t x);
|
|
|
|
#endif
|