1 diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20/README.pdfium 2 index b1012af..a40ed7b 100644 3 --- a/third_party/libopenjpeg20/README.pdfium 4 +++ b/third_party/libopenjpeg20/README.pdfium 5 @@ -29,4 +29,5 @@ Local Modifications: 6 0017-tcd_init_tile.patch: Prevent integer overflows during calculation of |l_nb_precinct_size|. 7 0018-tcd_get_decoded_tile_size.patch: Fix an integer overflow in opj_tcd_get_decoded_tile_size. 8 0019-tcd_init_tile.patch: Prevent integer overflows during calculation of |l_nb_code_blocks_size|. 9 +0020-opj_aligned_malloc.patch: Prevent overflows when using opj_aligned_malloc(). 10 TODO(thestig): List all the other patches. 11 diff --git a/third_party/libopenjpeg20/dwt.c b/third_party/libopenjpeg20/dwt.c 12 index 3b92bdf..a666d1c 100644 13 --- a/third_party/libopenjpeg20/dwt.c 14 +++ b/third_party/libopenjpeg20/dwt.c 15 @@ -576,6 +576,9 @@ static OPJ_BOOL opj_dwt_decode_tile(const opj_tcd_tilecomp_t* tilec, OPJ_UINT32 16 OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0); 17 18 h.mem_count = opj_dwt_max_resolution(tr, numres); 19 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < (OPJ_UINT32)h.mem_count) { 20 + return OPJ_FALSE; 21 + } 22 h.mem = (OPJ_INT32*)opj_aligned_malloc(h.mem_count * sizeof(OPJ_INT32)); 23 if (! h.mem){ 24 /* FIXME event manager error callback */ 25 @@ -850,7 +853,17 @@ OPJ_BOOL opj_dwt_decode_real(opj_tcd_tilecomp_t* restrict tilec, OPJ_UINT32 numr 26 27 OPJ_UINT32 w = (OPJ_UINT32)(tilec->x1 - tilec->x0); 28 29 - h.wavelet = (opj_v4_t*) opj_aligned_malloc((opj_dwt_max_resolution(res, numres)+5) * sizeof(opj_v4_t)); 30 + OPJ_UINT32 mr = opj_dwt_max_resolution(res, numres); 31 + 32 + if (mr >= ((OPJ_UINT32)-5)) { 33 + return OPJ_FALSE; 34 + } 35 + mr += 5; 36 + 37 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_v4_t) < mr) { 38 + return OPJ_FALSE; 39 + } 40 + h.wavelet = (opj_v4_t*) opj_aligned_malloc(mr * sizeof(opj_v4_t)); 41 if (!h.wavelet) { 42 /* FIXME event manager error callback */ 43 return OPJ_FALSE; 44 diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c 45 index 108ce78..a119db1 100644 46 --- a/third_party/libopenjpeg20/t1.c 47 +++ b/third_party/libopenjpeg20/t1.c 48 @@ -1173,6 +1173,9 @@ static OPJ_BOOL opj_t1_allocate_buffers( 49 if (!t1->encoder) { 50 if(datasize > t1->datasize){ 51 opj_aligned_free(t1->data); 52 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(OPJ_INT32) < datasize) { 53 + return OPJ_FALSE; 54 + } 55 t1->data = (OPJ_INT32*) opj_aligned_malloc(datasize * sizeof(OPJ_INT32)); 56 if(!t1->data){ 57 /* FIXME event manager error callback */ 58 @@ -1187,6 +1190,9 @@ static OPJ_BOOL opj_t1_allocate_buffers( 59 60 if(flagssize > t1->flagssize){ 61 opj_aligned_free(t1->flags); 62 + if (((OPJ_UINT32)-1) / (OPJ_UINT32)sizeof(opj_flag_t) < flagssize) { 63 + return OPJ_FALSE; 64 + } 65 t1->flags = (opj_flag_t*) opj_aligned_malloc(flagssize * sizeof(opj_flag_t)); 66 if(!t1->flags){ 67 /* FIXME event manager error callback */ 68
