Commit | Line | Data |
---|---|---|
90bcecc5 LF |
1 | Fix CVE-2014-8138 (heap overflow in jp2_decode()). |
2 | ||
3 | Copied from Fedora. | |
4 | ||
5 | http://pkgs.fedoraproject.org/cgit/rpms/jasper.git/tree/jasper-CVE-2014-8138.patch | |
6 | https://bugzilla.redhat.com/show_bug.cgi?id=1173162 | |
7 | ||
8 | --- jasper-1.900.1.orig/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:06:44.000000000 +0100 | |
9 | +++ jasper-1.900.1/src/libjasper/jp2/jp2_dec.c 2014-12-11 14:06:26.000000000 +0100 | |
10 | @@ -386,6 +386,11 @@ jas_image_t *jp2_decode(jas_stream_t *in | |
11 | /* Determine the type of each component. */ | |
12 | if (dec->cdef) { | |
13 | for (i = 0; i < dec->numchans; ++i) { | |
14 | + /* Is the channel number reasonable? */ | |
15 | + if (dec->cdef->data.cdef.ents[i].channo >= dec->numchans) { | |
16 | + jas_eprintf("error: invalid channel number in CDEF box\n"); | |
17 | + goto error; | |
18 | + } | |
19 | jas_image_setcmpttype(dec->image, | |
20 | dec->chantocmptlut[dec->cdef->data.cdef.ents[i].channo], | |
21 | jp2_getct(jas_image_clrspc(dec->image), |