From: Young_X <YangX92@hotmail.com>
Date: Fri, 23 Nov 2018 07:58:23 +0000 (+0800)
Subject: [JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987)
X-Git-Tag: v2.3.1~11^2~5
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=46822d0eddc3324b2a056bc60ffa997027bebd66;p=openjpeg

[JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987)

Signed-off-by: Young_X <YangX92@hotmail.com>
---

diff --git a/src/bin/jpwl/convert.c b/src/bin/jpwl/convert.c
index 04ca64ca..4f636c17 100644
--- a/src/bin/jpwl/convert.c
+++ b/src/bin/jpwl/convert.c
@@ -445,7 +445,7 @@ int imagetotga(opj_image_t * image, const char *outfile)
 {
     int width, height, bpp, x, y;
     opj_bool write_alpha;
-    int i, adjustR, adjustG, adjustB;
+    int i, adjustR, adjustG = 0, adjustB = 0;
     unsigned int alpha_channel;
     float r, g, b, a;
     unsigned char value;
@@ -486,8 +486,10 @@ int imagetotga(opj_image_t * image, const char *outfile)
     scale = 255.0f / (float)((1 << image->comps[0].prec) - 1);
 
     adjustR = (image->comps[0].sgnd ? 1 << (image->comps[0].prec - 1) : 0);
-    adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0);
-    adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0);
+    if (image->numcomps >= 3) {
+        adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0);
+        adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0);
+    }
 
     for (y = 0; y < height; y++) {
         unsigned int index = y * width;