PROJECT_MOVED -> https://lab.nexedi.com/nexedi/slapos
[slapos.git] / component / jasper / CVE-2014-8138.patch
1 Description: CVE-2014-8138: heap overflow in jp2_decode()
2 Origin: vendor, https://bugzilla.redhat.com/attachment.cgi?id=967280
3 Bug-Debian: https://bugs.debian.org/773463
4 Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1173162
5 Forwarded: no
6 Author: Tomas Hoger <thoger@redhat.com>
7 Last-Update: 2014-12-20
8
9 --- a/src/libjasper/jp2/jp2_dec.c
10 +++ b/src/libjasper/jp2/jp2_dec.c
11 @@ -389,6 +389,11 @@ jas_image_t *jp2_decode(jas_stream_t *in
12         /* Determine the type of each component. */
13         if (dec->cdef) {
14                 for (i = 0; i < dec->numchans; ++i) {
15 +                       /* Is the channel number reasonable? */
16 +                       if (dec->cdef->data.cdef.ents[i].channo >= dec->numchans) {
17 +                               jas_eprintf("error: invalid channel number in CDEF box\n");
18 +                               goto error;
19 +                       }
20                         jas_image_setcmpttype(dec->image,
21                           dec->chantocmptlut[dec->cdef->data.cdef.ents[i].channo],
22                           jp2_getct(jas_image_clrspc(dec->image),