openjpeg2/CVE-2016-10505.patch
2019-12-25 16:00:06 +08:00

46 lines
1.9 KiB
Diff

diff -Nur openjpeg-2.3.1_bak/src/bin/common/color.c openjpeg-2.3.1/src/bin/common/color.c
--- openjpeg-2.3.1_bak/src/bin/common/color.c 2019-10-14 06:31:49.372000000 -0400
+++ openjpeg-2.3.1/src/bin/common/color.c 2019-10-14 06:33:30.080000000 -0400
@@ -126,6 +126,7 @@
d1 = g = (int*)opj_image_data_alloc(sizeof(int) * max);
d2 = b = (int*)opj_image_data_alloc(sizeof(int) * max);
+ if(y == NULL || cb == NULL || cr == NULL) goto fails;
if (r == NULL || g == NULL || b == NULL) {
goto fails;
}
@@ -178,6 +179,7 @@
d1 = g = (int*)opj_image_data_alloc(sizeof(int) * max);
d2 = b = (int*)opj_image_data_alloc(sizeof(int) * max);
+ if(y == NULL || cb == NULL || cr == NULL) goto fails;
if (r == NULL || g == NULL || b == NULL) {
goto fails;
}
@@ -1062,6 +1064,7 @@
(image->comps[0].dx != image->comps[2].dx)
|| (image->comps[0].dy != image->comps[1].dy) ||
(image->comps[0].dy != image->comps[2].dy)
+ || !image->comps [0].data || !image->comps [1].data || !image->comps [2].data
) {
fprintf(stderr, "%s:%d:color_esycc_to_rgb\n\tCAN NOT CONVERT\n", __FILE__,
__LINE__);
diff -Nur openjpeg-2.3.1_bak/src/bin/jp2/convertbmp.c openjpeg-2.3.1/src/bin/jp2/convertbmp.c
--- openjpeg-2.3.1_bak/src/bin/jp2/convertbmp.c 2019-10-14 06:31:49.372000000 -0400
+++ openjpeg-2.3.1/src/bin/jp2/convertbmp.c 2019-10-14 06:34:34.480000000 -0400
@@ -889,6 +889,13 @@
image->comps[0].prec);
return 1;
}
+
+ for (i = 0; i < image->numcomps; i++) {
+ if (image->comps[i].data == NULL) {
+ fprintf(stderr, "Missing image data\n");
+ return 1;
+ }
+ }
if (image->numcomps >= 3 && image->comps[0].dx == image->comps[1].dx
&& image->comps[1].dx == image->comps[2].dx
&& image->comps[0].dy == image->comps[1].dy