Fix Heap Buffer Overflow in function color_cmyk_to_rgb

Fix uclouvain/openjpeg#774

diff --git a/src/bin/common/color.c b/src/bin/common/color.c
index 944df73b66de8d8870e8f53cd134fa3d73479953..234c7bdf8df647fa2c7a4a8664809cd626dc03f6 100644 (file)
--- a/src/bin/common/color.c
+++ b/src/bin/common/color.c
@@ -855,7 +855,14 @@ void color_cmyk_to_rgb(opj_image_t *image)
        w = image->comps[0].w;
        h = image->comps[0].h;
 
-       if(image->numcomps < 4) return;
+       if (
+                       (image->numcomps < 4)
+                || (image->comps[0].dx != image->comps[1].dx) || (image->comps[0].dx != image->comps[2].dx) || (image->comps[0].dx != image->comps[3].dx)
+                || (image->comps[0].dy != image->comps[1].dy) || (image->comps[0].dy != image->comps[2].dy) || (image->comps[0].dy != image->comps[3].dy)
+                       ) {
+               fprintf(stderr,"%s:%d:color_cmyk_to_rgb\n\tCAN NOT CONVERT\n", __FILE__,__LINE__);
+               return;
+       }
 
        max = w * h;
        

diff --git a/tests/nonregression/test_suite.ctest.in b/tests/nonregression/test_suite.ctest.in
index c48f66b298814d6e956227ecdd5f5b5d5e1d9158..1311221654b53a3c22fa102ef56f8b5e059fc01c 100644 (file)
--- a/tests/nonregression/test_suite.ctest.in
+++ b/tests/nonregression/test_suite.ctest.in
@@ -559,3 +559,5 @@ opj_decompress -i @INPUT_NR_PATH@/basn6a08.jp2 -o @TEMP_PATH@/basn6a08_tif-15.ti
 opj_decompress -i @INPUT_NR_PATH@/issue726.j2k -o @TEMP_PATH@/issue726.png
 # issue 733
 !opj_decompress -i @INPUT_NR_PATH@/issue733.jp2 -o @TEMP_PATH@/issue733.png
+# issue 774
+!opj_decompress -i @INPUT_NR_PATH@/issue774.jp2 -o @TEMP_PATH@/issue774.png