From aeef5293c978158255ad4f127089644745602f2a Mon Sep 17 00:00:00 2001 From: Michael Adams Date: Thu, 14 Dec 2023 19:04:19 -0800 Subject: [PATCH] Fixes #367. Fixed an integer-overflow bug in the ICC profile parsing code. Added another invalid image to the test set. --- data/test/bad/367-PoC.jp2 | Bin 0 -> 2916 bytes src/libjasper/base/jas_icc.c | 10 ++++++++++ 2 files changed, 10 insertions(+) create mode 100644 data/test/bad/367-PoC.jp2 diff --git a/data/test/bad/367-PoC.jp2 b/data/test/bad/367-PoC.jp2 new file mode 100644 index 0000000000000000000000000000000000000000..96e73789bd0e8983367d447b5084ed739479b0bf GIT binary patch literal 2916 zcma)84OCO-8Gdi>O~NqTsa3Gp;YF=QB`k>!NLx|<3?RcS{HVxALvr&Ymn7c&Ac`)< zt<`NF@u$aQtF2m@o8qRe?pTXetOwoJ8cVg4BZGCV73x;1uCB^l_I?Q@(8JkwZ|?n` z?|q-|eV_0BzI$%~K(R{CadELP#sa`3i>JZ0%BA5DL%5BJ!`6n~c)QIkVmm%`F>*PD zK>nu5DToq8Ape!o8}z&qDk+Z*6%t z;yD14i578jd6+MGcCD>!8RB@fo9&*$vLX9gM@`96#5h)Rpw_vB#37tZCU-8@5~d^W zvGIjujZqH`W&RSb;31W;xi>r)9dc=u{H;GOI$%UHf z1H7OkxiCK6;qvH*G|+txp@ihZ`7$i;4$To`(tRFVSwVO#lkO4AhQ>0L7W?ADA%3Gv z2<=7G#vByA2BHn)Ggpjaz78?QVeayda#AO;lFMp*j4>MQ+J z+9$n+_bzF7biDM2v>VSZ$i@{ALW=58l|8f)?g&pgY7Xtl^nelXA0y9+T8EX6T2YIm zIWg)XmEd12xnBZJsZp!yPpZGGuBrB`4ytaC$`Oq?s!H?@`XqgZev3X$zXu$Bj&7&V z(jD|~>9->>$6otzl*rnL=1Xj3wqzBC^Np-E4+5LRPGx7XdF(XyNwzq`;@AXM%@(jv zp=WAj-Gr!r)LiVa0&6u~)vzkYFQD%!%v>o}*&5J(XoCf4O zNX7x&GlafxRD2+6^L!s*!58?>x)QZjdI4J9015M>wiJ9PPJRvGRJzG4`oi&mqTUB^ zTjps(eM*so@1~w$@E*Reo0YsMI>p)F4V#NoY8pJed-nQNZWzWY)mlxO zDwX3h(=_~Cl_oaW4CGG`NXmfnI4}O2(szTBo>&N5bImL#3`t^TVBw=>N@ZtU< z*C6;AW;H7f1g<76oKr z?@*K+erWhe72EXZ+X11sx#dA@piTd+0mXy5qd(fc`YYILOUi!o3(Nyu9!YzeJb0 ztv%3ocYUAwev)51zPe>lQ?E%e{Jb)`^JlSzrlQ>~eepd(oA%x3f2iA(v$$~k^=y;# z`g5BeewJvJS|1)$)Mb1;-?#Qyf6<1j$=YXcUb(P0P`c?cW5U@cm1<|)+tUU!=T`cP zSN6Bu+H&`eU%a$&o5$}@h79*!m8~J6VDq704t(|cnZyU{3ckKsk^Ih0?sEF9qaPH!b^edCEnlZz zZmc?cg6*Pn3tA@}JG}q>Tcdata.txt; txt->string = 0; + /* The string must at least contain a single null character. */ + if (cnt < 1) { + goto error; + } if (!(txt->string = jas_malloc(cnt))) { goto error; } if (jas_stream_read(in, txt->string, cnt) != cnt) { goto error; } + /* Ensure that the string is null terminated. */ + if (txt->string[cnt - 1] != '\0') { + goto error; + } + /* The following line is redundant, unless we do not enforce that + the last character must be null. */ txt->string[cnt - 1] = '\0'; if (strlen(txt->string) + 1 != cnt) { goto error;