[trunk] Import patch from sumatrapdf team. This handle some testcase with no input...

Update issue 225

diff --git a/src/lib/openjp2/jp2.c b/src/lib/openjp2/jp2.c
index 3678be6786dfb788a5bf3501a6b3bf3e3823818a..0af1f960c4db8bee5a0ae516185d65d54d965fb0 100644 (file)
--- a/src/lib/openjp2/jp2.c
+++ b/src/lib/openjp2/jp2.c
@@ -980,6 +980,11 @@ OPJ_BOOL opj_jp2_read_pclr(        opj_jp2_t *jp2,
                for(i = 0; i < nr_channels; ++i) {
                        OPJ_INT32 bytes_to_read = (channel_size[i]+7)>>3;
 
+                       if (bytes_to_read > sizeof(OPJ_UINT32))
+                               bytes_to_read = sizeof(OPJ_UINT32);
+                       if ((ptrdiff_t)p_pclr_header_size < p_pclr_header_data - orig_header_data + bytes_to_read)
+                               return OPJ_FALSE;
+
                        if (bytes_to_read > sizeof(OPJ_UINT32))
                                bytes_to_read = sizeof(OPJ_UINT32);
                        if ((ptrdiff_t)p_pclr_header_size < p_pclr_header_data - orig_header_data + bytes_to_read)
@@ -1031,6 +1036,11 @@ OPJ_BOOL opj_jp2_read_cmap(      opj_jp2_t * jp2,
                return OPJ_FALSE;
        }
 
+       if (p_cmap_header_size < (OPJ_UINT32)nr_channels * 4) {
+               opj_event_msg(p_manager, EVT_ERROR, "Insufficient data for CMAP box.\n");
+               return OPJ_FALSE;
+       }
+
        cmap = (opj_jp2_cmap_comp_t*) opj_malloc(nr_channels * sizeof(opj_jp2_cmap_comp_t));
     if (!cmap)
         return OPJ_FALSE;
@@ -1122,6 +1132,11 @@ OPJ_BOOL opj_jp2_read_cdef(      opj_jp2_t * jp2,
                return OPJ_FALSE;
        }
 
+       if (p_cdef_header_size < 2) {
+               opj_event_msg(p_manager, EVT_ERROR, "Insufficient data for CDEF box.\n");
+               return OPJ_FALSE;
+       }
+
        opj_read_bytes(p_cdef_header_data,&l_value ,2);                 /* N */
        p_cdef_header_data+= 2;
 
@@ -1135,6 +1150,11 @@ OPJ_BOOL opj_jp2_read_cdef(      opj_jp2_t * jp2,
                return OPJ_FALSE;
        }
 
+       if (p_cdef_header_size < 2 + (OPJ_UINT32)(OPJ_UINT16)l_value * 6) {
+               opj_event_msg(p_manager, EVT_ERROR, "Insufficient data for CDEF box.\n");
+               return OPJ_FALSE;
+       }
+
        cdef_info = (opj_jp2_cdef_info_t*) opj_malloc(l_value * sizeof(opj_jp2_cdef_info_t));
     if (!cdef_info)
         return OPJ_FALSE;