| commit 839936aa33eb8899bbbd80fda02796bb65068951 | |
| Author: Even Rouault <even.rouault@spatialys.com> | |
| Date: Sun Apr 5 13:25:27 2026 +0200 | |
| opj_pi_initialise_encode() (write code path): avoid potential integer overflow leading to insufficient memory allocation | |
| Fixes #1619 | |
| diff --git a/src/pi.c b/src/pi.c | |
| index ad96f47..b199a7b 100644 | |
| --- a/src/pi.c | |
| +++ b/src/pi.c | |
| @@ -1703,9 +1703,12 @@ opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *p_image, | |
| l_current_pi = l_pi; | |
| /* memory allocation for include*/ | |
| - l_current_pi->include_size = l_tcp->numlayers * l_step_l; | |
| - l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, | |
| - sizeof(OPJ_INT16)); | |
| + l_current_pi->include = NULL; | |
| + if (l_step_l <= UINT_MAX / l_tcp->numlayers) { | |
| + l_current_pi->include_size = l_tcp->numlayers * l_step_l; | |
| + l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, | |
| + sizeof(OPJ_INT16)); | |
| + } | |
| if (!l_current_pi->include) { | |
| opj_free(l_tmp_data); | |
| opj_free(l_tmp_ptr); |