[trunk] Import patch from sumatrapdf team. Add a new function to check color box.

Update issue 225

diff --git a/src/lib/openjp2/jp2.c b/src/lib/openjp2/jp2.c
index 9dde2e97485f86ed6c2ededf78786fec0485b896..3678be6786dfb788a5bf3501a6b3bf3e3823818a 100644 (file)
--- a/src/lib/openjp2/jp2.c
+++ b/src/lib/openjp2/jp2.c
@@ -752,6 +752,77 @@ void opj_jp2_free_pclr(opj_jp2_color_t *color)
     opj_free(color->jp2_pclr); color->jp2_pclr = NULL;
 }
 
+static OPJ_BOOL opj_jp2_check_color(opj_image_t *image, opj_jp2_color_t *color, opj_event_mgr_t *p_manager)
+{
+       OPJ_UINT16 i;
+
+       /* testcase 4149.pdf.SIGSEGV.cf7.3501 */
+       if (color->jp2_cdef) {
+               opj_jp2_cdef_info_t *info = color->jp2_cdef->info;
+               OPJ_UINT16 n = color->jp2_cdef->n;
+
+               for (i = 0; i < n; i++) {
+                       if (info[i].cn >= image->numcomps) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Invalid component index %d (>= %d).\n", info[i].cn, image->numcomps);
+                               return OPJ_FALSE;
+                       }
+                       if (info[i].asoc > 0 && (OPJ_UINT32)(info[i].asoc - 1) >= image->numcomps) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Invalid component index %d (>= %d).\n", info[i].asoc - 1, image->numcomps);
+                               return OPJ_FALSE;
+                       }
+               }
+       }
+
+       /* testcases 451.pdf.SIGSEGV.f4c.3723, 451.pdf.SIGSEGV.5b5.3723 and
+          66ea31acbb0f23a2bbc91f64d69a03f5_signal_sigsegv_13937c0_7030_5725.pdf */
+       if (color->jp2_pclr && color->jp2_pclr->cmap) {
+               OPJ_UINT16 nr_channels = color->jp2_pclr->nr_channels;
+               opj_jp2_cmap_comp_t *cmap = color->jp2_pclr->cmap;
+               OPJ_BOOL *pcol_usage, is_sane = OPJ_TRUE;
+
+               /* verify that all original components match an existing one */
+               for (i = 0; i < nr_channels; i++) {
+                       if (cmap[i].cmp >= image->numcomps) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Invalid component index %d (>= %d).\n", cmap[i].cmp, image->numcomps);
+                               is_sane = OPJ_FALSE;
+                       }
+               }
+
+               pcol_usage = opj_calloc(nr_channels, sizeof(OPJ_BOOL));
+               if (!pcol_usage) {
+                       opj_event_msg(p_manager, EVT_ERROR, "Unexpected OOM.\n");
+                       return OPJ_FALSE;
+               }
+               /* verify that no component is targeted more than once */
+               for (i = 0; i < nr_channels; i++) {
+                       OPJ_UINT16 pcol = cmap[i].pcol;
+                       if (pcol >= nr_channels) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Invalid component/palette index for direct mapping %d.\n", pcol);
+                               is_sane = OPJ_FALSE;
+                       }
+                       else if (pcol_usage[pcol]) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Component %d is mapped twice.\n", pcol);
+                               is_sane = OPJ_FALSE;
+                       }
+                       else
+                               pcol_usage[pcol] = OPJ_TRUE;
+               }
+               /* verify that all components are targeted at least once */
+               for (i = 0; i < nr_channels; i++) {
+                       if (!pcol_usage[i]) {
+                               opj_event_msg(p_manager, EVT_ERROR, "Component %d doesn't have a mapping.\n", i);
+                               is_sane = OPJ_FALSE;
+                       }
+               }
+               opj_free(pcol_usage);
+               if (!is_sane) {
+                       return OPJ_FALSE;
+               }
+       }
+
+       return OPJ_TRUE;
+}
+
 void opj_jp2_apply_pclr(opj_image_t *image, opj_jp2_color_t *color)
 {
        opj_image_comp_t *old_comps, *new_comps;
@@ -1188,6 +1259,9 @@ OPJ_BOOL opj_jp2_decode(opj_jp2_t *jp2,
        }
 
     if (!jp2->ignore_pclr_cmap_cdef){
+           if (!opj_jp2_check_color(p_image, &(jp2->color), p_manager)) {
+                   return OPJ_FALSE;
+           }
 
            /* Set Image Color Space */
            if (jp2->enumcs == 16)
@@ -2368,6 +2442,10 @@ OPJ_BOOL opj_jp2_get_tile(       opj_jp2_t *p_jp2,
                return OPJ_FALSE;
        }
 
+       if (!opj_jp2_check_color(p_image, &(p_jp2->color), p_manager)) {
+               return OPJ_FALSE;
+       }
+
        /* Set Image Color Space */
        if (p_jp2->enumcs == 16)
                p_image->color_space = OPJ_CLRSPC_SRGB;