From: Even Rouault <even.rouault@spatialys.com>
Date: Mon, 3 Jul 2017 12:33:57 +0000 (+0200)
Subject: opj_j2k_read_header_procedure(): validate marker size to avoid excessive memory alloc... 
X-Git-Tag: v2.2.0~65
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c308de39edc1697efbd5c10dc4852a58f9b86558;p=openjpeg

opj_j2k_read_header_procedure(): validate marker size to avoid excessive memory allocation attempt
---

diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
index 4c2b9326..f908c655 100644
--- a/src/lib/openjp2/j2k.c
+++ b/src/lib/openjp2/j2k.c
@@ -7711,6 +7711,10 @@ static OPJ_BOOL opj_j2k_read_header_procedure(opj_j2k_t *p_j2k,
         /* read 2 bytes as the marker size */
         opj_read_bytes(p_j2k->m_specific_param.m_decoder.m_header_data, &l_marker_size,
                        2);
+        if (l_marker_size < 2) {
+            opj_event_msg(p_manager, EVT_ERROR, "Invalid marker size\n");
+            return OPJ_FALSE;
+        }
         l_marker_size -= 2; /* Subtract the size of the marker ID already read */
 
         /* Check if the marker size is compatible with the header data size */