From e93d5341d87c54713a9632c8823288fa901a3b78 Mon Sep 17 00:00:00 2001 From: Bo Xu Date: Fri, 3 Oct 2014 12:29:54 -0700 Subject: check pointer overflow in t2.c BUG=413375 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/624023003 --- core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c') diff --git a/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c b/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c index f2a7c9a57c..cdd35e8c22 100644 --- a/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c +++ b/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c @@ -1132,7 +1132,7 @@ OPJ_BOOL opj_t2_read_packet_data( opj_t2_t* p_t2, do { /* Check possible overflow (on l_current_data only, assumes input args already checked) then size */ - if (((OPJ_SIZE_T)(l_current_data + l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) { + if ((((OPJ_SIZE_T)l_current_data + (OPJ_SIZE_T)l_seg->newlen) < (OPJ_SIZE_T)l_current_data) || (l_current_data + l_seg->newlen > p_src_data + p_max_length)) { fprintf(stderr, "read: segment too long (%d) with max (%d) for codeblock %d (p=%d, b=%d, r=%d, c=%d)\n", l_seg->newlen, p_max_length, cblkno, p_pi->precno, bandno, p_pi->resno, p_pi->compno); return OPJ_FALSE; -- cgit v1.2.3