File jasper-CVE-2016-9583.patch of Package jasper

Overview Repositories Revisions Requests Users Attributes Meta

File jasper-CVE-2016-9583.patch of Package jasper (Revision f1d8187117801ea269e859c1778956d3)

Currently displaying revision f1d8187117801ea269e859c1778956d3 , Show latest

--- jasper-1.900.14/src/libjasper/include/jasper/jas_types.h	2017-03-22 10:14:30.098037013 +0100
+++ jasper-1.900.14/src/libjasper/include/jasper/jas_types.h	2017-03-22 10:15:11.619685037 +0100
@@ -128,6 +128,10 @@
 #define	JAS_CAST(t, e) \
 	((t) (e))
 
+/* The number of bits in the integeral type uint_fast32_t. */
+/* NOTE: This could underestimate the size on some exotic architectures. */
+#define JAS_UINTFAST32_NUMBITS (8 * sizeof(uint_fast32_t))
+
 #ifdef __cplusplus
 extern "C" {
 #endif
--- jasper-1.900.14/src/libjasper/jpc/jpc_t2cod.c	2017-03-22 10:14:30.102037013 +0100
+++ jasper-1.900.14/src/libjasper/jpc/jpc_t2cod.c	2017-03-22 10:15:11.619685037 +0100
@@ -200,7 +200,8 @@
 		  JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
 			for (pi->compno = pchg->compnostart, pi->picomp =
 			  &pi->picomps[pi->compno]; pi->compno < pi->numcomps &&
-			  pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno, ++pi->picomp) {
+			  pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno,
+			  ++pi->picomp) {
 				if (pi->rlvlno >= pi->picomp->numrlvls) {
 					continue;
 				}
@@ -249,10 +250,17 @@
 		  ++compno, ++picomp) {
 			for (rlvlno = 0, pirlvl = picomp->pirlvls; rlvlno <
 			  picomp->numrlvls; ++rlvlno, ++pirlvl) {
-				xstep = picomp->hsamp * (1 << (pirlvl->prcwidthexpn +
-				  picomp->numrlvls - rlvlno - 1));
-				ystep = picomp->vsamp * (1 << (pirlvl->prcheightexpn +
-				  picomp->numrlvls - rlvlno - 1));
+				// Check for the potential for overflow problems.
+				if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2 ||
+				  pirlvl->prcheightexpn + pi->picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2) {
+					return -1;
+				}
+				xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
+				ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
 				pi->xstep = (!pi->xstep) ? xstep : JAS_MIN(pi->xstep, xstep);
 				pi->ystep = (!pi->ystep) ? ystep : JAS_MIN(pi->ystep, ystep);
 			}
@@ -282,21 +290,24 @@
 					rpy = r + pi->pirlvl->prcheightexpn;
 					trx0 = JPC_CEILDIV(pi->xstart, pi->picomp->hsamp << r);
 					try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
-					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx)))
-					  || !(pi->x % (1 << rpx))) &&
-					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy)))
-					  || !(pi->y % (1 << rpy)))) {
-						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
-						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
-						  pi->pirlvl->prcwidthexpn);
-						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
-						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
-						  pi->pirlvl->prcheightexpn);
+					if (((pi->x == pi->xstart &&
+					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx)))
+					  || !(pi->x % (JAS_CAST(uint_fast32_t, 1) << rpx))) &&
+					  ((pi->y == pi->ystart &&
+					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy)))
+					  || !(pi->y % (JAS_CAST(uint_fast32_t, 1) << rpy)))) {
+						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
 						pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
 
 						assert(pi->prcno < pi->pirlvl->numprcs);
 						for (pi->lyrno = 0; pi->lyrno <
-						  pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+						  pi->numlyrs && pi->lyrno < JAS_CAST(int,
+						  pchg->lyrnoend); ++pi->lyrno) {
 							prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
 							if (pi->lyrno >= *prclyrno) {
 								++(*prclyrno);
@@ -341,16 +352,19 @@
 		  ++compno, ++picomp) {
 			for (rlvlno = 0, pirlvl = picomp->pirlvls; rlvlno <
 			  picomp->numrlvls; ++rlvlno, ++pirlvl) {
-				xstep = picomp->hsamp * (1 <<
-				  (pirlvl->prcwidthexpn + picomp->numrlvls -
-				  rlvlno - 1));
-				ystep = picomp->vsamp * (1 <<
-				  (pirlvl->prcheightexpn + picomp->numrlvls -
-				  rlvlno - 1));
-				pi->xstep = (!pi->xstep) ? xstep :
-				  JAS_MIN(pi->xstep, xstep);
-				pi->ystep = (!pi->ystep) ? ystep :
-				  JAS_MIN(pi->ystep, ystep);
+				// Check for the potential for overflow problems.
+				if (pirlvl->prcwidthexpn + picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2 ||
+				  pirlvl->prcheightexpn + picomp->numrlvls >
+				  JAS_UINTFAST32_NUMBITS - 2) {
+					return -1;
+				}
+				xstep = picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcwidthexpn + picomp->numrlvls - rlvlno - 1));
+				ystep = picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
+				  (pirlvl->prcheightexpn + picomp->numrlvls - rlvlno - 1));
+				pi->xstep = (!pi->xstep) ? xstep : JAS_MIN(pi->xstep, xstep);
+				pi->ystep = (!pi->ystep) ? ystep : JAS_MIN(pi->ystep, ystep);
 			}
 		}
 		pi->prgvolfirst = 0;
@@ -377,20 +391,23 @@
 					try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
 					rpx = r + pi->pirlvl->prcwidthexpn;
 					rpy = r + pi->pirlvl->prcheightexpn;
-					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
+					if (((pi->x == pi->xstart &&
+					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
 					  !(pi->x % (pi->picomp->hsamp << rpx))) &&
-					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
+					  ((pi->y == pi->ystart &&
+					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
 					  !(pi->y % (pi->picomp->vsamp << rpy)))) {
-						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
-						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
-						  pi->pirlvl->prcwidthexpn);
-						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
-						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
-						  pi->pirlvl->prcheightexpn);
+						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
 						pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
 						assert(pi->prcno < pi->pirlvl->numprcs);
 						for (pi->lyrno = 0; pi->lyrno < pi->numlyrs &&
-						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
+						  ++pi->lyrno) {
 							prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
 							if (pi->lyrno >= *prclyrno) {
 								++(*prclyrno);
@@ -428,10 +445,17 @@
 		pi->prgvolfirst = 0;
 	}
 
-	for (pi->compno = pchg->compnostart, pi->picomp =
-	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
-	  ++pi->picomp) {
+	for (pi->compno = pchg->compnostart, pi->picomp = &pi->picomps[pi->compno];
+	  pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps;
+	  ++pi->compno, ++pi->picomp) {
 		pirlvl = pi->picomp->pirlvls;
+		// Check for the potential for overflow problems.
+		if (pirlvl->prcwidthexpn + pi->picomp->numrlvls >
+		  JAS_UINTFAST32_NUMBITS - 2 ||
+		  pirlvl->prcheightexpn + pi->picomp->numrlvls >
+		  JAS_UINTFAST32_NUMBITS - 2) {
+			return -1;
+		}
 		pi->xstep = pi->picomp->hsamp * (JAS_CAST(uint_fast32_t, 1) <<
 		  (pirlvl->prcwidthexpn + pi->picomp->numrlvls - 1));
 		pi->ystep = pi->picomp->vsamp * (JAS_CAST(uint_fast32_t, 1) <<
@@ -461,23 +485,23 @@
 					try0 = JPC_CEILDIV(pi->ystart, pi->picomp->vsamp << r);
 					rpx = r + pi->pirlvl->prcwidthexpn;
 					rpy = r + pi->pirlvl->prcheightexpn;
-					if (((pi->x == pi->xstart && ((trx0 << r) % (1 << rpx))) ||
+					if (((pi->x == pi->xstart &&
+					  ((trx0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpx))) ||
 					  !(pi->x % (pi->picomp->hsamp << rpx))) &&
-					  ((pi->y == pi->ystart && ((try0 << r) % (1 << rpy))) ||
+					  ((pi->y == pi->ystart &&
+					  ((try0 << r) % (JAS_CAST(uint_fast32_t, 1) << rpy))) ||
 					  !(pi->y % (pi->picomp->vsamp << rpy)))) {
-						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x, pi->picomp->hsamp
-						  << r), pi->pirlvl->prcwidthexpn) - JPC_FLOORDIVPOW2(trx0,
-						  pi->pirlvl->prcwidthexpn);
-						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y, pi->picomp->vsamp
-						  << r), pi->pirlvl->prcheightexpn) - JPC_FLOORDIVPOW2(try0,
-						  pi->pirlvl->prcheightexpn);
-						pi->prcno = prcvind *
-						  pi->pirlvl->numhprcs +
-						  prchind;
-						assert(pi->prcno <
-						  pi->pirlvl->numprcs);
-						for (pi->lyrno = 0; pi->lyrno <
-						  pi->numlyrs && pi->lyrno < JAS_CAST(int, pchg->lyrnoend); ++pi->lyrno) {
+						prchind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->x,
+						  pi->picomp->hsamp << r), pi->pirlvl->prcwidthexpn) -
+						  JPC_FLOORDIVPOW2(trx0, pi->pirlvl->prcwidthexpn);
+						prcvind = JPC_FLOORDIVPOW2(JPC_CEILDIV(pi->y,
+						  pi->picomp->vsamp << r), pi->pirlvl->prcheightexpn) -
+						  JPC_FLOORDIVPOW2(try0, pi->pirlvl->prcheightexpn);
+						pi->prcno = prcvind * pi->pirlvl->numhprcs + prchind;
+						assert(pi->prcno < pi->pirlvl->numprcs);
+						for (pi->lyrno = 0; pi->lyrno < pi->numlyrs &&
+						  pi->lyrno < JAS_CAST(int, pchg->lyrnoend);
+						  ++pi->lyrno) {
 							prclyrno = &pi->pirlvl->prclyrnos[pi->prcno];
 							if (pi->lyrno >= *prclyrno) {
 								++(*prclyrno);
--- jasper-1.900.14/src/libjasper/jpc/jpc_t2dec.c	2017-03-22 10:14:30.102037013 +0100
+++ jasper-1.900.14/src/libjasper/jpc/jpc_t2dec.c	2017-03-22 10:15:11.619685037 +0100
@@ -454,8 +454,8 @@
 			  jas_stream_getrwcount(in), jpc_pi_prg(pi), jpc_pi_cmptno(pi),
 			  jpc_pi_rlvlno(pi), jpc_pi_prcno(pi), jpc_pi_lyrno(pi));
 		}
-		if (jpc_dec_decodepkt(dec, pkthdrstream, in, jpc_pi_cmptno(pi), jpc_pi_rlvlno(pi),
-		  jpc_pi_prcno(pi), jpc_pi_lyrno(pi))) {
+		if (jpc_dec_decodepkt(dec, pkthdrstream, in, jpc_pi_cmptno(pi),
+		  jpc_pi_rlvlno(pi), jpc_pi_prcno(pi), jpc_pi_lyrno(pi))) {
 			return -1;
 		}
 ++dec->numpkts;

Places

File jasper-CVE-2016-9583.patch of Package jasper (Revision f1d8187117801ea269e859c1778956d3)

Places