mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-11-25 08:23:09 +00:00
jasper: 1.900.2 -> 1.900.21 (security)
Incorporates fixes from all patches for the CVEs listed and some more security-related issues like: http://www.openwall.com/lists/oss-security/2016/11/04/11
This commit is contained in:
Franz Pletz
parent
a66f9b2a02
commit
624de33091
@ -1,27 +1,13 @@
|
||||
{ stdenv, fetchurl, fetchpatch, libjpeg, autoreconfHook }:
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
name = "jasper-1.900.2";
|
||||
name = "jasper-1.900.21";
|
||||
|
||||
src = fetchurl {
|
||||
url = "http://www.ece.uvic.ca/~mdadams/jasper/software/${name}.tar.gz";
|
||||
sha256 = "0bkibjhq3js2ldxa2f9pss84lcx4f5d3v0qis3ifi11ciy7a6c9a";
|
||||
sha256 = "1cypmlzq5vmbacsn8n3ls9p7g64scv3fzx88qf8c270dz10s5j79";
|
||||
};
|
||||
|
||||
patches = [
|
||||
./jasper-CVE-2014-8137-variant2.diff
|
||||
./jasper-CVE-2014-8137-noabort.diff
|
||||
|
||||
(fetchpatch { # CVE-2016-2089
|
||||
url = "https://github.com/mdadams/jasper/commit/aa6d9c2bbae9155f8e1466295373a68fa97291c3.patch";
|
||||
sha256 = "1pxnm86zmbq6brfwsm5wx3iv7s92n4xilc52lzp61q266jmlggrf";
|
||||
})
|
||||
(fetchpatch { # CVE-2015-5203
|
||||
url = "https://github.com/mdadams/jasper/commit/e73bb58f99fec0bf9c5d8866e010fcf736a53b9a.patch";
|
||||
sha256 = "1r6hxbnhpnb7q6p2kbdxc1cpph3ic851x2hy477yv5c3qmrbx9bk";
|
||||
})
|
||||
];
|
||||
|
||||
# newer reconf to recognize a multiout flag
|
||||
nativeBuildInputs = [ autoreconfHook ];
|
||||
propagatedBuildInputs = [ libjpeg ];
|
||||
|
||||
@ -1,16 +0,0 @@
|
||||
From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=967284&action=diff
|
||||
|
||||
--- jasper-1.900.1.orig/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:30:54.193209780 +0100
|
||||
+++ jasper-1.900.1/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:36:46.313217814 +0100
|
||||
@@ -291,7 +291,10 @@ jas_image_t *jp2_decode(jas_stream_t *in
|
||||
case JP2_COLR_ICC:
|
||||
iccprof = jas_iccprof_createfrombuf(dec->colr->data.colr.iccp,
|
||||
dec->colr->data.colr.iccplen);
|
||||
- assert(iccprof);
|
||||
+ if (!iccprof) {
|
||||
+ jas_eprintf("error: failed to parse ICC profile\n");
|
||||
+ goto error;
|
||||
+ }
|
||||
jas_iccprof_gethdr(iccprof, &icchdr);
|
||||
jas_eprintf("ICC Profile CS %08x\n", icchdr.colorspc);
|
||||
jas_image_setclrspc(dec->image, fromiccpcs(icchdr.colorspc));
|
||||
@ -1,45 +0,0 @@
|
||||
From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=967283&action=diff
|
||||
|
||||
--- jasper-1.900.1.orig/src/libjasper/base/jas_icc.c 2014-12-11 14:06:44.000000000 +0100
|
||||
+++ jasper-1.900.1/src/libjasper/base/jas_icc.c 2014-12-11 15:16:37.971272386 +0100
|
||||
@@ -1009,7 +1009,6 @@ static int jas_icccurv_input(jas_iccattr
|
||||
return 0;
|
||||
|
||||
error:
|
||||
- jas_icccurv_destroy(attrval);
|
||||
return -1;
|
||||
}
|
||||
|
||||
@@ -1127,7 +1126,6 @@ static int jas_icctxtdesc_input(jas_icca
|
||||
#endif
|
||||
return 0;
|
||||
error:
|
||||
- jas_icctxtdesc_destroy(attrval);
|
||||
return -1;
|
||||
}
|
||||
|
||||
@@ -1206,8 +1204,6 @@ static int jas_icctxt_input(jas_iccattrv
|
||||
goto error;
|
||||
return 0;
|
||||
error:
|
||||
- if (txt->string)
|
||||
- jas_free(txt->string);
|
||||
return -1;
|
||||
}
|
||||
|
||||
@@ -1328,7 +1324,6 @@ static int jas_icclut8_input(jas_iccattr
|
||||
goto error;
|
||||
return 0;
|
||||
error:
|
||||
- jas_icclut8_destroy(attrval);
|
||||
return -1;
|
||||
}
|
||||
|
||||
@@ -1497,7 +1492,6 @@ static int jas_icclut16_input(jas_iccatt
|
||||
goto error;
|
||||
return 0;
|
||||
error:
|
||||
- jas_icclut16_destroy(attrval);
|
||||
return -1;
|
||||
}
|
||||
|
||||
@ -1,16 +0,0 @@
|
||||
From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=967280&action=diff
|
||||
|
||||
--- jasper-1.900.1.orig/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:06:44.000000000 +0100
|
||||
+++ jasper-1.900.1/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:06:26.000000000 +0100
|
||||
@@ -386,6 +386,11 @@ jas_image_t *jp2_decode(jas_stream_t *in
|
||||
/* Determine the type of each component. */
|
||||
if (dec->cdef) {
|
||||
for (i = 0; i < dec->numchans; ++i) {
|
||||
+ /* Is the channel number reasonable? */
|
||||
+ if (dec->cdef->data.cdef.ents[i].channo >= dec->numchans) {
|
||||
+ jas_eprintf("error: invalid channel number in CDEF box\n");
|
||||
+ goto error;
|
||||
+ }
|
||||
jas_image_setcmpttype(dec->image,
|
||||
dec->chantocmptlut[dec->cdef->data.cdef.ents[i].channo],
|
||||
jp2_getct(jas_image_clrspc(dec->image),
|
||||
@ -1,12 +0,0 @@
|
||||
diff -up jasper-1.900.1/src/libjasper/jpc/jpc_dec.c.CVE-2014-8157 jasper-1.900.1/src/libjasper/jpc/jpc_dec.c
|
||||
--- jasper-1.900.1/src/libjasper/jpc/jpc_dec.c.CVE-2014-8157 2015-01-19 16:59:36.000000000 +0100
|
||||
+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c 2015-01-19 17:07:41.609863268 +0100
|
||||
@@ -489,7 +489,7 @@ static int jpc_dec_process_sot(jpc_dec_t
|
||||
dec->curtileendoff = 0;
|
||||
}
|
||||
|
||||
- if (JAS_CAST(int, sot->tileno) > dec->numtiles) {
|
||||
+ if (JAS_CAST(int, sot->tileno) >= dec->numtiles) {
|
||||
jas_eprintf("invalid tile number in SOT marker segment\n");
|
||||
return -1;
|
||||
}
|
||||
@ -1,329 +0,0 @@
|
||||
diff -up jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c.CVE-2014-8158 jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c
|
||||
--- jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c.CVE-2014-8158 2015-01-19 17:25:28.730195502 +0100
|
||||
+++ jasper-1.900.1/src/libjasper/jpc/jpc_qmfb.c 2015-01-19 17:27:20.214663127 +0100
|
||||
@@ -306,11 +306,7 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numcols, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE];
|
||||
-#else
|
||||
- jpc_fix_t splitbuf[bufsize];
|
||||
-#endif
|
||||
jpc_fix_t *buf = splitbuf;
|
||||
register jpc_fix_t *srcptr;
|
||||
register jpc_fix_t *dstptr;
|
||||
@@ -318,7 +314,6 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in
|
||||
register int m;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Get a buffer. */
|
||||
if (bufsize > QMFB_SPLITBUFSIZE) {
|
||||
if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
|
||||
@@ -326,7 +321,6 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
if (numcols >= 2) {
|
||||
hstartcol = (numcols + 1 - parity) >> 1;
|
||||
@@ -360,12 +354,10 @@ void jpc_qmfb_split_row(jpc_fix_t *a, in
|
||||
}
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the split buffer was allocated on the heap, free this memory. */
|
||||
if (buf != splitbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@@ -374,11 +366,7 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numrows, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE];
|
||||
-#else
|
||||
- jpc_fix_t splitbuf[bufsize];
|
||||
-#endif
|
||||
jpc_fix_t *buf = splitbuf;
|
||||
register jpc_fix_t *srcptr;
|
||||
register jpc_fix_t *dstptr;
|
||||
@@ -386,7 +374,6 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in
|
||||
register int m;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Get a buffer. */
|
||||
if (bufsize > QMFB_SPLITBUFSIZE) {
|
||||
if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
|
||||
@@ -394,7 +381,6 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
if (numrows >= 2) {
|
||||
hstartcol = (numrows + 1 - parity) >> 1;
|
||||
@@ -428,12 +414,10 @@ void jpc_qmfb_split_col(jpc_fix_t *a, in
|
||||
}
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the split buffer was allocated on the heap, free this memory. */
|
||||
if (buf != splitbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@@ -442,11 +426,7 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a,
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numrows, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE];
|
||||
-#else
|
||||
- jpc_fix_t splitbuf[bufsize * JPC_QMFB_COLGRPSIZE];
|
||||
-#endif
|
||||
jpc_fix_t *buf = splitbuf;
|
||||
jpc_fix_t *srcptr;
|
||||
jpc_fix_t *dstptr;
|
||||
@@ -457,7 +437,6 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a,
|
||||
int m;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Get a buffer. */
|
||||
if (bufsize > QMFB_SPLITBUFSIZE) {
|
||||
if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
|
||||
@@ -465,7 +444,6 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a,
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
if (numrows >= 2) {
|
||||
hstartcol = (numrows + 1 - parity) >> 1;
|
||||
@@ -517,12 +495,10 @@ void jpc_qmfb_split_colgrp(jpc_fix_t *a,
|
||||
}
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the split buffer was allocated on the heap, free this memory. */
|
||||
if (buf != splitbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@@ -531,11 +507,7 @@ void jpc_qmfb_split_colres(jpc_fix_t *a,
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numrows, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t splitbuf[QMFB_SPLITBUFSIZE * JPC_QMFB_COLGRPSIZE];
|
||||
-#else
|
||||
- jpc_fix_t splitbuf[bufsize * numcols];
|
||||
-#endif
|
||||
jpc_fix_t *buf = splitbuf;
|
||||
jpc_fix_t *srcptr;
|
||||
jpc_fix_t *dstptr;
|
||||
@@ -546,7 +518,6 @@ void jpc_qmfb_split_colres(jpc_fix_t *a,
|
||||
int m;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Get a buffer. */
|
||||
if (bufsize > QMFB_SPLITBUFSIZE) {
|
||||
if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
|
||||
@@ -554,7 +525,6 @@ void jpc_qmfb_split_colres(jpc_fix_t *a,
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
if (numrows >= 2) {
|
||||
hstartcol = (numrows + 1 - parity) >> 1;
|
||||
@@ -606,12 +576,10 @@ void jpc_qmfb_split_colres(jpc_fix_t *a,
|
||||
}
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the split buffer was allocated on the heap, free this memory. */
|
||||
if (buf != splitbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@@ -619,18 +587,13 @@ void jpc_qmfb_join_row(jpc_fix_t *a, int
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numcols, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t joinbuf[QMFB_JOINBUFSIZE];
|
||||
-#else
|
||||
- jpc_fix_t joinbuf[bufsize];
|
||||
-#endif
|
||||
jpc_fix_t *buf = joinbuf;
|
||||
register jpc_fix_t *srcptr;
|
||||
register jpc_fix_t *dstptr;
|
||||
register int n;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Allocate memory for the join buffer from the heap. */
|
||||
if (bufsize > QMFB_JOINBUFSIZE) {
|
||||
if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
|
||||
@@ -638,7 +601,6 @@ void jpc_qmfb_join_row(jpc_fix_t *a, int
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
hstartcol = (numcols + 1 - parity) >> 1;
|
||||
|
||||
@@ -670,12 +632,10 @@ void jpc_qmfb_join_row(jpc_fix_t *a, int
|
||||
++srcptr;
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the join buffer was allocated on the heap, free this memory. */
|
||||
if (buf != joinbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@@ -684,18 +644,13 @@ void jpc_qmfb_join_col(jpc_fix_t *a, int
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numrows, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t joinbuf[QMFB_JOINBUFSIZE];
|
||||
-#else
|
||||
- jpc_fix_t joinbuf[bufsize];
|
||||
-#endif
|
||||
jpc_fix_t *buf = joinbuf;
|
||||
register jpc_fix_t *srcptr;
|
||||
register jpc_fix_t *dstptr;
|
||||
register int n;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Allocate memory for the join buffer from the heap. */
|
||||
if (bufsize > QMFB_JOINBUFSIZE) {
|
||||
if (!(buf = jas_alloc2(bufsize, sizeof(jpc_fix_t)))) {
|
||||
@@ -703,7 +658,6 @@ void jpc_qmfb_join_col(jpc_fix_t *a, int
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
hstartcol = (numrows + 1 - parity) >> 1;
|
||||
|
||||
@@ -735,12 +689,10 @@ void jpc_qmfb_join_col(jpc_fix_t *a, int
|
||||
++srcptr;
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the join buffer was allocated on the heap, free this memory. */
|
||||
if (buf != joinbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@@ -749,11 +701,7 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a,
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numrows, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t joinbuf[QMFB_JOINBUFSIZE * JPC_QMFB_COLGRPSIZE];
|
||||
-#else
|
||||
- jpc_fix_t joinbuf[bufsize * JPC_QMFB_COLGRPSIZE];
|
||||
-#endif
|
||||
jpc_fix_t *buf = joinbuf;
|
||||
jpc_fix_t *srcptr;
|
||||
jpc_fix_t *dstptr;
|
||||
@@ -763,7 +711,6 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a,
|
||||
register int i;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Allocate memory for the join buffer from the heap. */
|
||||
if (bufsize > QMFB_JOINBUFSIZE) {
|
||||
if (!(buf = jas_alloc2(bufsize, JPC_QMFB_COLGRPSIZE * sizeof(jpc_fix_t)))) {
|
||||
@@ -771,7 +718,6 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a,
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
hstartcol = (numrows + 1 - parity) >> 1;
|
||||
|
||||
@@ -821,12 +767,10 @@ void jpc_qmfb_join_colgrp(jpc_fix_t *a,
|
||||
srcptr += JPC_QMFB_COLGRPSIZE;
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the join buffer was allocated on the heap, free this memory. */
|
||||
if (buf != joinbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@@ -835,11 +779,7 @@ void jpc_qmfb_join_colres(jpc_fix_t *a,
|
||||
{
|
||||
|
||||
int bufsize = JPC_CEILDIVPOW2(numrows, 1);
|
||||
-#if !defined(HAVE_VLA)
|
||||
jpc_fix_t joinbuf[QMFB_JOINBUFSIZE * JPC_QMFB_COLGRPSIZE];
|
||||
-#else
|
||||
- jpc_fix_t joinbuf[bufsize * numcols];
|
||||
-#endif
|
||||
jpc_fix_t *buf = joinbuf;
|
||||
jpc_fix_t *srcptr;
|
||||
jpc_fix_t *dstptr;
|
||||
@@ -849,7 +789,6 @@ void jpc_qmfb_join_colres(jpc_fix_t *a,
|
||||
register int i;
|
||||
int hstartcol;
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* Allocate memory for the join buffer from the heap. */
|
||||
if (bufsize > QMFB_JOINBUFSIZE) {
|
||||
if (!(buf = jas_alloc3(bufsize, numcols, sizeof(jpc_fix_t)))) {
|
||||
@@ -857,7 +796,6 @@ void jpc_qmfb_join_colres(jpc_fix_t *a,
|
||||
abort();
|
||||
}
|
||||
}
|
||||
-#endif
|
||||
|
||||
hstartcol = (numrows + 1 - parity) >> 1;
|
||||
|
||||
@@ -907,12 +845,10 @@ void jpc_qmfb_join_colres(jpc_fix_t *a,
|
||||
srcptr += numcols;
|
||||
}
|
||||
|
||||
-#if !defined(HAVE_VLA)
|
||||
/* If the join buffer was allocated on the heap, free this memory. */
|
||||
if (buf != joinbuf) {
|
||||
jas_free(buf);
|
||||
}
|
||||
-#endif
|
||||
|
||||
}
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
From RedHat: https://bugzilla.redhat.com/attachment.cgi?id=961994&action=diff
|
||||
|
||||
--- jasper-1.900.1.orig/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:45:44.000000000 +0100
|
||||
+++ jasper-1.900.1/src/libjasper/jpc/jpc_dec.c 2014-11-27 12:44:58.000000000 +0100
|
||||
@@ -1281,7 +1281,7 @@ static int jpc_dec_process_coc(jpc_dec_t
|
||||
jpc_coc_t *coc = &ms->parms.coc;
|
||||
jpc_dec_tile_t *tile;
|
||||
|
||||
- if (JAS_CAST(int, coc->compno) > dec->numcomps) {
|
||||
+ if (JAS_CAST(int, coc->compno) >= dec->numcomps) {
|
||||
jas_eprintf("invalid component number in COC marker segment\n");
|
||||
return -1;
|
||||
}
|
||||
@@ -1307,7 +1307,7 @@ static int jpc_dec_process_rgn(jpc_dec_t
|
||||
jpc_rgn_t *rgn = &ms->parms.rgn;
|
||||
jpc_dec_tile_t *tile;
|
||||
|
||||
- if (JAS_CAST(int, rgn->compno) > dec->numcomps) {
|
||||
+ if (JAS_CAST(int, rgn->compno) >= dec->numcomps) {
|
||||
jas_eprintf("invalid component number in RGN marker segment\n");
|
||||
return -1;
|
||||
}
|
||||
@@ -1356,7 +1356,7 @@ static int jpc_dec_process_qcc(jpc_dec_t
|
||||
jpc_qcc_t *qcc = &ms->parms.qcc;
|
||||
jpc_dec_tile_t *tile;
|
||||
|
||||
- if (JAS_CAST(int, qcc->compno) > dec->numcomps) {
|
||||
+ if (JAS_CAST(int, qcc->compno) >= dec->numcomps) {
|
||||
jas_eprintf("invalid component number in QCC marker segment\n");
|
||||
return -1;
|
||||
}
|
||||
@ -1,11 +0,0 @@
|
||||
--- jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c 2007-01-19 22:43:07.000000000 +0100
|
||||
+++ jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c 2016-01-14 14:22:24.569056412 +0100
|
||||
@@ -429,7 +429,7 @@
|
||||
}
|
||||
|
||||
for (pi->compno = pchg->compnostart, pi->picomp =
|
||||
- &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno,
|
||||
+ &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
|
||||
++pi->picomp) {
|
||||
pirlvl = pi->picomp->pirlvls;
|
||||
pi->xstep = pi->picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
|
||||
Loading…
Reference in New Issue
Block a user