diff options
Diffstat (limited to 'third_party')
| -rw-r--r-- | third_party/libopenjpeg20/0005-jp2_apply_pclr.patch | 49 | ||||
| -rw-r--r-- | third_party/libopenjpeg20/README.pdfium | 1 | ||||
| -rw-r--r-- | third_party/libopenjpeg20/jp2.c | 14 |
3 files changed, 57 insertions, 7 deletions
diff --git a/third_party/libopenjpeg20/0005-jp2_apply_pclr.patch b/third_party/libopenjpeg20/0005-jp2_apply_pclr.patch new file mode 100644 index 0000000000..fd3ca634ca --- /dev/null +++ b/third_party/libopenjpeg20/0005-jp2_apply_pclr.patch @@ -0,0 +1,49 @@ +diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c +index 47f83a1..6e910a9 100644 +--- a/third_party/libopenjpeg20/jp2.c ++++ b/third_party/libopenjpeg20/jp2.c +@@ -902,7 +902,7 @@ static OPJ_BOOL opj_jp2_check_color(opj_image_t *image, opj_jp2_color_t *color, + opj_event_msg(p_manager, EVT_ERROR, "Invalid component/palette index for direct mapping %d.\n", pcol); + is_sane = OPJ_FALSE; + } +- else if (pcol_usage[pcol] && cmap[i].mtyp == 1) { ++ else if (pcol_usage[pcol] && cmap[i].mtyp != 0) { + opj_event_msg(p_manager, EVT_ERROR, "Component %d is mapped twice.\n", pcol); + is_sane = OPJ_FALSE; + } +@@ -982,8 +982,8 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_color_t *color) + assert( pcol == 0 ); + new_comps[i] = old_comps[cmp]; + } else { +- assert( i == pcol ); +- new_comps[pcol] = old_comps[cmp]; ++ assert( i == pcol ); // probably wrong? ++ new_comps[i] = old_comps[cmp]; + } + + /* Palette mapping: */ +@@ -1007,11 +1007,11 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_color_t *color) + cmp = cmap[i].cmp; pcol = cmap[i].pcol; + src = old_comps[cmp].data; + assert( src ); +- max = new_comps[pcol].w * new_comps[pcol].h; ++ max = new_comps[i].w * new_comps[i].h; + + /* Direct use: */ + if(cmap[i].mtyp == 0) { +- assert( cmp == 0 ); ++ assert( cmp == 0 ); // probably wrong. + dst = new_comps[i].data; + assert( dst ); + for(j = 0; j < max; ++j) { +@@ -1019,8 +1019,8 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_color_t *color) + } + } + else { +- assert( i == pcol ); +- dst = new_comps[pcol].data; ++ assert( i == pcol ); // probably wrong? ++ dst = new_comps[i].data; + assert( dst ); + for(j = 0; j < max; ++j) { + /* The index */ diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20/README.pdfium index 728c0d8b99..67f2f6e500 100644 --- a/third_party/libopenjpeg20/README.pdfium +++ b/third_party/libopenjpeg20/README.pdfium @@ -14,4 +14,5 @@ Local Modifications: 0002-packet-iterator.patch: Fix integer overflow in opj_pi_create_decode(). 0003-dwt-decode.patch: Check array bounds for opj_dwt_decode_1() and friends. 0004-j2k_read_mcc.patch: Move incrementing of l_tcp->m_nb_mcc_records to the right place. +0005-jp2_apply_pclr.patch: Fix out of bounds access. TODO(thestig): List all the other patches. diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c index 47f83a1abc..6e910a911a 100644 --- a/third_party/libopenjpeg20/jp2.c +++ b/third_party/libopenjpeg20/jp2.c @@ -902,7 +902,7 @@ static OPJ_BOOL opj_jp2_check_color(opj_image_t *image, opj_jp2_color_t *color, opj_event_msg(p_manager, EVT_ERROR, "Invalid component/palette index for direct mapping %d.\n", pcol); is_sane = OPJ_FALSE; } - else if (pcol_usage[pcol] && cmap[i].mtyp == 1) { + else if (pcol_usage[pcol] && cmap[i].mtyp != 0) { opj_event_msg(p_manager, EVT_ERROR, "Component %d is mapped twice.\n", pcol); is_sane = OPJ_FALSE; } @@ -982,8 +982,8 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_color_t *color) assert( pcol == 0 ); new_comps[i] = old_comps[cmp]; } else { - assert( i == pcol ); - new_comps[pcol] = old_comps[cmp]; + assert( i == pcol ); // probably wrong? + new_comps[i] = old_comps[cmp]; } /* Palette mapping: */ @@ -1007,11 +1007,11 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_color_t *color) cmp = cmap[i].cmp; pcol = cmap[i].pcol; src = old_comps[cmp].data; assert( src ); - max = new_comps[pcol].w * new_comps[pcol].h; + max = new_comps[i].w * new_comps[i].h; /* Direct use: */ if(cmap[i].mtyp == 0) { - assert( cmp == 0 ); + assert( cmp == 0 ); // probably wrong. dst = new_comps[i].data; assert( dst ); for(j = 0; j < max; ++j) { @@ -1019,8 +1019,8 @@ static void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_color_t *color) } } else { - assert( i == pcol ); - dst = new_comps[pcol].data; + assert( i == pcol ); // probably wrong? + dst = new_comps[i].data; assert( dst ); for(j = 0; j < max; ++j) { /* The index */ |