diff options
| author | mayeut <mayeut@users.noreply.github.com> | 2015-09-06 17:24:03 +0200 |
|---|---|---|
| committer | MSe <mse1969@posteo.de> | 2017-06-09 13:45:16 +0200 |
| commit | 38f4724f96137a4c39697c478a092cea5a8984a0 (patch) | |
| tree | af0ef03053b66fd913a1e558136b0e960a290733 | |
| parent | 8f8b2f2cf16b238825a11715ad3b85e063b601bb (diff) | |
| download | android_external_pdfium-38f4724f96137a4c39697c478a092cea5a8984a0.tar.gz android_external_pdfium-38f4724f96137a4c39697c478a092cea5a8984a0.tar.bz2 android_external_pdfium-38f4724f96137a4c39697c478a092cea5a8984a0.zip | |
Fix potential use-after-free in opj_j2k_write_mco function
Fixes #563
Upstream-commit:
https://github.com/uclouvain/openjpeg/commit/
940100c28ae28931722290794889cf84a92c5f6f
CVE-2015-8871
Change-Id: I2183dc65cb2fc0db40d7e92702770eb8aa376964
| -rw-r--r-- | core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c b/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c index 7b4bc58..cbd9a0e 100644 --- a/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c +++ b/core/src/fxcodec/fx_libopenjpeg/libopenjpeg20/j2k.c @@ -5616,7 +5616,6 @@ OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, assert(p_stream != 00); l_tcp =&(p_j2k->m_cp.tcps[p_j2k->m_current_tile_number]); - l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; l_mco_size = 5 + l_tcp->m_nb_mcc_records; if (l_mco_size > p_j2k->m_specific_param.m_encoder.m_header_tile_data_size) { @@ -5632,6 +5631,8 @@ OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, p_j2k->m_specific_param.m_encoder.m_header_tile_data = new_header_tile_data; p_j2k->m_specific_param.m_encoder.m_header_tile_data_size = l_mco_size; } + l_current_data = p_j2k->m_specific_param.m_encoder.m_header_tile_data; + opj_write_bytes(l_current_data,J2K_MS_MCO,2); /* MCO */ l_current_data += 2; @@ -5643,10 +5644,9 @@ OPJ_BOOL opj_j2k_write_mco( opj_j2k_t *p_j2k, ++l_current_data; l_mcc_record = l_tcp->m_mcc_records; - for (i=0;i<l_tcp->m_nb_mcc_records;++i) { + for (i=0;i<l_tcp->m_nb_mcc_records;++i) { opj_write_bytes(l_current_data,l_mcc_record->m_index,1);/* Imco -> use the mcc indicated by 1*/ ++l_current_data; - ++l_mcc_record; } |