36 lines
1.2 KiB
Diff
36 lines
1.2 KiB
Diff
|
From 24fc4d6f01d2d4c8297d1bebec02360f796e01c2 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Michael Vetter <jubalh@iodoru.org>
|
||
|
|
Date: Mon, 4 Nov 2019 18:17:44 +0100
|
||
|
|
Subject: [PATCH] Verify range data in jp2_pclr_getdata
|
||
|
|
|
||
|
|
This fixes CVE-2018-19541.
|
||
|
|
We need to verify the data is in the expected range. Otherwise we get
|
||
|
|
problems later.
|
||
|
|
|
||
|
|
This is a better fix for https://github.com/mdadams/jasper/pull/199
|
||
|
|
which caused segfaults under certain circumstances.
|
||
|
|
|
||
|
|
Patch by Adam Majer <adam.majer@suse.de>
|
||
|
|
Signed-off-by: Michael Vetter <jubalh@iodoru.org>
|
||
|
|
---
|
||
|
|
src/libjasper/jp2/jp2_cod.c | 6 ++++++
|
||
|
|
1 file changed, 6 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/src/libjasper/jp2/jp2_cod.c b/src/libjasper/jp2/jp2_cod.c
|
||
|
|
index 890e6ad..0f8d804 100644
|
||
|
|
--- a/src/libjasper/jp2/jp2_cod.c
|
||
|
|
+++ b/src/libjasper/jp2/jp2_cod.c
|
||
|
|
@@ -855,6 +855,12 @@ static int jp2_pclr_getdata(jp2_box_t *box, jas_stream_t *in)
|
||
|
|
jp2_getuint8(in, &pclr->numchans)) {
|
||
|
|
return -1;
|
||
|
|
}
|
||
|
|
+
|
||
|
|
+ // verify in range data as per I.5.3.4 - Palette box
|
||
|
|
+ if (pclr->numchans < 1 || pclr->numlutents < 1 || pclr->numlutents > 1024) {
|
||
|
|
+ return -1;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
lutsize = pclr->numlutents * pclr->numchans;
|
||
|
|
if (!(pclr->lutdata = jas_alloc2(lutsize, sizeof(int_fast32_t)))) {
|
||
|
|
return -1;
|