opj_j2k_is_imf_compliant: Fix out of bounds access. 1366/head
authorSebastian Rasmussen <sebras@gmail.com>
Mon, 12 Jul 2021 13:31:28 +0000 (15:31 +0200)
committerSebastian Rasmussen <sebras@gmail.com>
Mon, 12 Jul 2021 13:32:39 +0000 (15:32 +0200)
Previously when mainlevel was parsed == 12 openjpeg would generate
a warning, but then the sublevel value would be compared to an out
of bounds element in the tabMaxSubLevelFromMainLevel array. From
this commit OpenJPEG will only use mainlevel if in range.

src/lib/openjp2/j2k.c

index c3696edbf6f3fa04b8dc004258dcde4d457a94ee..c9aa4eee8fee26f7c025d09ce2d501bf91d4cbb9 100644 (file)
@@ -7101,19 +7101,21 @@ static OPJ_BOOL opj_j2k_is_imf_compliant(opj_cparameters_t *parameters,
                       mainlevel);
         ret = OPJ_FALSE;
     }
-
-    /* Validate sublevel */
-    assert(sizeof(tabMaxSubLevelFromMainLevel) ==
-           (OPJ_IMF_MAINLEVEL_MAX + 1) * sizeof(tabMaxSubLevelFromMainLevel[0]));
-    if (sublevel > tabMaxSubLevelFromMainLevel[mainlevel]) {
-        opj_event_msg(p_manager, EVT_WARNING,
-                      "IMF profile require sublevel <= %d for mainlevel = %d.\n"
-                      "-> %d is thus not compliant\n"
-                      "-> Non-IMF codestream will be generated\n",
-                      tabMaxSubLevelFromMainLevel[mainlevel],
-                      mainlevel,
-                      sublevel);
-        ret = OPJ_FALSE;
+    else
+    {
+        /* Validate sublevel */
+        assert(sizeof(tabMaxSubLevelFromMainLevel) ==
+               (OPJ_IMF_MAINLEVEL_MAX + 1) * sizeof(tabMaxSubLevelFromMainLevel[0]));
+        if (sublevel > tabMaxSubLevelFromMainLevel[mainlevel]) {
+            opj_event_msg(p_manager, EVT_WARNING,
+                          "IMF profile require sublevel <= %d for mainlevel = %d.\n"
+                          "-> %d is thus not compliant\n"
+                          "-> Non-IMF codestream will be generated\n",
+                          tabMaxSubLevelFromMainLevel[mainlevel],
+                          mainlevel,
+                          sublevel);
+            ret = OPJ_FALSE;
+        }
     }
 
     /* Number of components */