commit 338a6b75994eb148d429b7abccfffaf7ae9f9b55
author stackexploit <stackexploit@gmail.com> Mon Jun 20 11:23:46 2016 -0700
committer Commit bot <commit-bot@chromium.org> Mon Jun 20 11:23:46 2016 -0700
tree 539b10bfa8efa07d21e7e48399efe8895936aae0
parent c5a8f217fedc1224104b34f7577044776a9d83d8

openjpeg: Prevent a buffer overflow in opj_j2k_read_SQcd_SQcc.

BUG=chromium:619405

R=ochang@chromium.org

Review-Url: https://codereview.chromium.org/2071773002

third_party/libopenjpeg20/0016-read_SQcd_SQcc_overflow.patch

diff --git a/third_party/libopenjpeg20/0016-read_SQcd_SQcc_overflow.patch b/third_party/libopenjpeg20/0016-read_SQcd_SQcc_overflow.patch
new file mode 100644
index 0000000..7b8bfca
--- /dev/null
+++ b/third_party/libopenjpeg20/0016-read_SQcd_SQcc_overflow.patch
@@ -0,0 +1,15 @@
+diff --git a/third_party/libopenjpeg20/j2k.c b/third_party/libopenjpeg20/j2k.c
+index c7aa8db..b5f6fe9 100644
+--- a/third_party/libopenjpeg20/j2k.c
++++ b/third_party/libopenjpeg20/j2k.c
+@@ -9010,7 +9010,9 @@ static OPJ_BOOL opj_j2k_read_SQcd_SQcc(opj_j2k_t *p_j2k,
+                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
+ 
+         /* precondition again*/
+-        assert(p_comp_no <  p_j2k->m_private_image->numcomps);
++        if (p_comp_no >=  p_j2k->m_private_image->numcomps) {
++            return OPJ_FALSE;
++        }
+ 
+         l_tccp = &l_tcp->tccps[p_comp_no];
+         l_current_ptr = p_header_data;

third_party/libopenjpeg20/README.pdfium

diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20/README.pdfium
index 559f1c1..4852a42 100644
--- a/third_party/libopenjpeg20/README.pdfium
+++ b/third_party/libopenjpeg20/README.pdfium
@@ -25,4 +25,5 @@
 0013-attrib_fix.patch: Don't needlessly redefine __attribute__, https://github.com/uclouvain/openjpeg/issues/727
 0014-opj_jp2_read_ihdr_leak.patch: Memory leak in opj_jp2_read_ihdr().
 0015-read_SPCod_SPCoc_overflow.patch: Prevent a buffer overflow in opj_j2k_read_SPCod_SPCoc.
+0016-read_SQcd_SQcc_overflow.patch: Prevent a buffer overflow in opj_j2k_read_SQcd_SQcc.
 TODO(thestig): List all the other patches.

third_party/libopenjpeg20/j2k.c

diff --git a/third_party/libopenjpeg20/j2k.c b/third_party/libopenjpeg20/j2k.c
index c7aa8db..b5f6fe9 100644
--- a/third_party/libopenjpeg20/j2k.c
+++ b/third_party/libopenjpeg20/j2k.c
@@ -9010,7 +9010,9 @@
                                 p_j2k->m_specific_param.m_decoder.m_default_tcp;
 
         /* precondition again*/
-        assert(p_comp_no <  p_j2k->m_private_image->numcomps);
+        if (p_comp_no >=  p_j2k->m_private_image->numcomps) {
+            return OPJ_FALSE;
+        }
 
         l_tccp = &l_tcp->tccps[p_comp_no];
         l_current_ptr = p_header_data;