27 lines
841 B
Diff
27 lines
841 B
Diff
From fd564ee3377d9fc2484c657e4f464a3fb9764d31 Mon Sep 17 00:00:00 2001
|
|
From: Max Kellermann <max.kellermann@gmail.com>
|
|
Date: Mon, 29 Jun 2020 13:47:09 +0200
|
|
Subject: [PATCH] jpc_enc: validate raw_size, prevent division by zero in
|
|
cp_create()
|
|
|
|
Closes https://github.com/mdadams/jasper/issues/194 (part 1)
|
|
---
|
|
src/libjasper/jpc/jpc_enc.c | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/src/libjasper/jpc/jpc_enc.c b/src/libjasper/jpc/jpc_enc.c
|
|
index d60a4471..3b6b1e81 100644
|
|
--- a/src/libjasper/jpc/jpc_enc.c
|
|
+++ b/src/libjasper/jpc/jpc_enc.c
|
|
@@ -428,6 +428,10 @@ static jpc_enc_cp_t *cp_create(const char *optstr, jas_image_t *image)
|
|
}
|
|
|
|
cp->rawsize = jas_image_rawsize(image);
|
|
+ if (cp->rawsize == 0) {
|
|
+ /* prevent division by zero in cp_create() */
|
|
+ goto error;
|
|
+ }
|
|
cp->totalsize = UINT_FAST32_MAX;
|
|
|
|
tcp = &cp->tcp;
|