diff options
author | Matthieu Darbois <mayeut@users.noreply.github.com> | 2016-09-06 22:33:26 +0200 |
---|---|---|
committer | MSe <mse1969@posteo.de> | 2017-06-09 14:02:22 +0200 |
commit | 04f5d1a877557dfa582541a4fc631d57d303c7a2 (patch) | |
tree | 5d62f4d321badf0fcb5369be14a5b85176bb5717 | |
parent | 38f4724f96137a4c39697c478a092cea5a8984a0 (diff) | |
download | android_external_pdfium-cm-13.0.tar.gz android_external_pdfium-cm-13.0.tar.bz2 android_external_pdfium-cm-13.0.zip |
fix incrementing of "l_tcp->m_nb_mcc_records" in opj_j2k_read_mcc (#820)HEADreplicant-6.0-0004-transitionreplicant-6.0-0004-rc6replicant-6.0-0004-rc5-transitionreplicant-6.0-0004-rc5replicant-6.0-0004-rc4replicant-6.0-0004-rc3replicant-6.0-0004-rc2replicant-6.0-0004-rc1replicant-6.0-0004replicant-6.0-0003replicant-6.0-0002cm-13.0
Upstream-commit:
https://github.com/uclouvain/openjpeg/commit/
734d57d5f7842aa7c2c9f36d62131ab4d8bd6c87
CVE-2016-8332
Change-Id: I4eaee1718a529d3fafb025469c087090ec5ab3be
-rw-r--r-- | core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c b/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c index cbd9a0e..24d637b 100644 --- a/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c +++ b/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c @@ -5398,6 +5398,7 @@ OPJ_BOOL opj_j2k_read_mcc ( opj_j2k_t *p_j2k, OPJ_UINT32 l_nb_collections; OPJ_UINT32 l_nb_comps; OPJ_UINT32 l_nb_bytes_by_comp; + OPJ_BOOL l_new_mcc = OPJ_FALSE; /* preconditions */ assert(p_header_data != 00); @@ -5459,6 +5460,7 @@ OPJ_BOOL opj_j2k_read_mcc ( opj_j2k_t *p_j2k, memset(l_mcc_record,0,(l_tcp->m_nb_max_mcc_records-l_tcp->m_nb_mcc_records) * sizeof(opj_simple_mcc_decorrelation_data_t)); } l_mcc_record = l_tcp->m_mcc_records + l_tcp->m_nb_mcc_records; + l_new_mcc = OPJ_TRUE; } l_mcc_record->m_index = l_indix; @@ -5594,8 +5596,9 @@ OPJ_BOOL opj_j2k_read_mcc ( opj_j2k_t *p_j2k, return OPJ_FALSE; } - ++l_tcp->m_nb_mcc_records; - + if (l_new_mcc) { + ++l_tcp->m_nb_mcc_records; + } return OPJ_TRUE; } |