Avoid heap buffer overflow in function pnmtoimage of convert.c, and unsigned integer...

diff --git a/src/bin/jp2/convert.c b/src/bin/jp2/convert.c
index b3eb85816a229dedca9f56c5e8017de101163ca3..492911c90f672a3e7a31ecb7128675719324c813 100644 (file)
--- a/src/bin/jp2/convert.c
+++ b/src/bin/jp2/convert.c
@@ -41,6 +41,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
+#include <limits.h>
 
 #include "openjpeg.h"
 #include "convert.h"
@@ -1731,6 +1732,15 @@ opj_image_t* pnmtoimage(const char *filename, opj_cparameters_t *parameters)
         return NULL;
     }
 
+    /* This limitation could be removed by making sure to use size_t below */
+    if (header_info.height != 0 &&
+            header_info.width > INT_MAX / header_info.height) {
+        fprintf(stderr, "pnmtoimage:Image %dx%d too big!\n",
+                header_info.width, header_info.height);
+        fclose(fp);
+        return NULL;
+    }
+
     format = header_info.format;
 
     switch (format) {

diff --git a/src/lib/openjp2/image.c b/src/lib/openjp2/image.c
index e62b416ca6299116c1b7978dbf42bc419a84f808..d00a23701b1545be80a673f1929794bfee062857 100644 (file)
--- a/src/lib/openjp2/image.c
+++ b/src/lib/openjp2/image.c
@@ -68,7 +68,13 @@ opj_image_t* OPJ_CALLCONV opj_image_create(OPJ_UINT32 numcmpts,
             comp->prec = cmptparms[compno].prec;
             comp->bpp = cmptparms[compno].bpp;
             comp->sgnd = cmptparms[compno].sgnd;
-            comp->data = (OPJ_INT32*) opj_calloc(comp->w * comp->h, sizeof(OPJ_INT32));
+            if (comp->h != 0 && (OPJ_SIZE_T)comp->w > SIZE_MAX / comp->h) {
+                // TODO event manager
+                opj_image_destroy(image);
+                return NULL;
+            }
+            comp->data = (OPJ_INT32*) opj_calloc((OPJ_SIZE_T)comp->w * comp->h,
+                                                 sizeof(OPJ_INT32));
             if (!comp->data) {
                 /* TODO replace with event manager, breaks API */
                 /* fprintf(stderr,"Unable to allocate memory for image.\n"); */