From: Even Rouault <even.rouault@spatialys.com>
Date: Sat, 29 Jul 2017 14:34:35 +0000 (+0200)
Subject: opj_t1_decode_cblk(): avoid undefined shift behaviour. Fixes https://bugs.chromium... 
X-Git-Tag: v2.2.0~37
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=db9ef99f6dd054a84fa8382c02869fb0656abfc8;p=openjpeg

opj_t1_decode_cblk(): avoid undefined shift behaviour. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2487. Credit to OSS Fuzz
---

diff --git a/src/lib/openjp2/t1.c b/src/lib/openjp2/t1.c
index 3615a0e6..9ab7af30 100644
--- a/src/lib/openjp2/t1.c
+++ b/src/lib/openjp2/t1.c
@@ -1822,6 +1822,18 @@ static OPJ_BOOL opj_t1_decode_cblk(opj_t1_t *t1,
     }
 
     bpno_plus_one = (OPJ_INT32)(roishift + cblk->numbps);
+    if (bpno_plus_one >= 31) {
+        if (p_manager_mutex) {
+            opj_mutex_lock(p_manager_mutex);
+        }
+        opj_event_msg(p_manager, EVT_WARNING,
+                      "opj_t1_decode_cblk(): unsupported bpno_plus_one = %d >= 31\n",
+                      bpno_plus_one);
+        if (p_manager_mutex) {
+            opj_mutex_unlock(p_manager_mutex);
+        }
+        return OPJ_FALSE;
+    }
     passtype = 2;
 
     opj_mqc_resetstates(mqc);