Patch CVE-2026-6192 in libopenjpeg Apply https://github.com/uclouvain/openjpeg/pull/1619 Bug: 514547039 Change-Id: Icae4d89c2a578623c81fe616beab6385def1d8e2 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/147950 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org>
diff --git a/third_party/libopenjpeg/0050-opj_pi_initialise_encode_overflow.patch b/third_party/libopenjpeg/0050-opj_pi_initialise_encode_overflow.patch new file mode 100644 index 0000000..1f44a5d --- /dev/null +++ b/third_party/libopenjpeg/0050-opj_pi_initialise_encode_overflow.patch
@@ -0,0 +1,28 @@ +commit 839936aa33eb8899bbbd80fda02796bb65068951 +Author: Even Rouault <even.rouault@spatialys.com> +Date: Sun Apr 5 13:25:27 2026 +0200 + + opj_pi_initialise_encode() (write code path): avoid potential integer overflow leading to insufficient memory allocation + + Fixes #1619 + +diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c +index 15ac3314..4abb87af 100644 +--- a/src/lib/openjp2/pi.c ++++ b/src/lib/openjp2/pi.c +@@ -1694,9 +1694,12 @@ opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *p_image, + l_current_pi = l_pi; + + /* memory allocation for include*/ +- l_current_pi->include_size = l_tcp->numlayers * l_step_l; +- l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, +- sizeof(OPJ_INT16)); ++ l_current_pi->include = NULL; ++ if (l_step_l <= UINT_MAX / l_tcp->numlayers) { ++ l_current_pi->include_size = l_tcp->numlayers * l_step_l; ++ l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, ++ sizeof(OPJ_INT16)); ++ } + if (!l_current_pi->include) { + opj_free(l_tmp_data); + opj_free(l_tmp_ptr);
diff --git a/third_party/libopenjpeg/README.pdfium b/third_party/libopenjpeg/README.pdfium index bea8e5c..9006106 100644 --- a/third_party/libopenjpeg/README.pdfium +++ b/third_party/libopenjpeg/README.pdfium
@@ -33,8 +33,9 @@ 0041-remove_opj_clock.patch: Remove unused opj_clock.h include. 0046-func-ptr-mixup.patch: Prevent mixing up function pointer types. 0047-opj_j2k_read_sod.patch: Cherry-pick https://github.com/uclouvain/openjpeg/pull/1621 -0048-dwt_neon_9-7_idwt.patch Cherry-pick https://github.com/uclouvain/openjpeg/pull/1629 -0049-dwt_neon_5-3_idwt.patch Cherry-pick https://github.com/uclouvain/openjpeg/pull/1630 +0048-dwt_neon_9-7_idwt.patch: Cherry-pick https://github.com/uclouvain/openjpeg/pull/1629 +0049-dwt_neon_5-3_idwt.patch: Cherry-pick https://github.com/uclouvain/openjpeg/pull/1630 +0050-opj_pi_initialise_encode_overflow.patch: Cherry-pick https://github.com/uclouvain/openjpeg/pull/1619 Note:
diff --git a/third_party/libopenjpeg/pi.c b/third_party/libopenjpeg/pi.c index ad96f47..b199a7b 100644 --- a/third_party/libopenjpeg/pi.c +++ b/third_party/libopenjpeg/pi.c
@@ -1703,9 +1703,12 @@ l_current_pi = l_pi; /* memory allocation for include*/ - l_current_pi->include_size = l_tcp->numlayers * l_step_l; - l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, - sizeof(OPJ_INT16)); + l_current_pi->include = NULL; + if (l_step_l <= UINT_MAX / l_tcp->numlayers) { + l_current_pi->include_size = l_tcp->numlayers * l_step_l; + l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, + sizeof(OPJ_INT16)); + } if (!l_current_pi->include) { opj_free(l_tmp_data); opj_free(l_tmp_ptr);