From: Antonin Descampe <antonin@gmail.com>
Date: Tue, 30 Sep 2014 09:48:26 +0000 (+0000)
Subject: [trunk] fixes heap-buffer-overflow in parse_cmdline_encoder
X-Git-Tag: wg1n6848~27
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1acfa211ae85f2716064f041868f0fc5d6427590;p=openjpeg

[trunk] fixes heap-buffer-overflow in parse_cmdline_encoder

Fixes issue 403
Thanks Matthieu
---

diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c
index db21c5a4..55828b1f 100644
--- a/src/bin/jp2/opj_compress.c
+++ b/src/bin/jp2/opj_compress.c
@@ -1501,12 +1501,10 @@ static int parse_cmdline_encoder(int argc, char **argv, opj_cparameters_t *param
     }
 
     /* If subsampled image is provided, automatically disable MCT */
-    if ( ((parameters->decod_format == RAW_DFMT)
-          || (parameters->decod_format == RAWL_DFMT))
-         && ((raw_cp->rawComps[1].dx > 1)
-             || (raw_cp->rawComps[1].dy > 1)
-             || (raw_cp->rawComps[2].dx > 1)
-             || (raw_cp->rawComps[2].dy > 1))) {
+    if ( ((parameters->decod_format == RAW_DFMT) || (parameters->decod_format == RAWL_DFMT))
+         && (   ((raw_cp->rawComp > 1 ) && ((raw_cp->rawComps[1].dx > 1) || (raw_cp->rawComps[1].dy > 1)))
+             || ((raw_cp->rawComp > 2 ) && ((raw_cp->rawComps[2].dx > 1) || (raw_cp->rawComps[2].dy > 1)))
+						)) {
         parameters->tcp_mct = 0;
     }