diff options
| -rw-r--r-- | gnu/local.mk | 2 | ||||
| -rw-r--r-- | gnu/packages/gstreamer.scm | 11 | ||||
| -rw-r--r-- | gnu/packages/image.scm | 6 | ||||
| -rw-r--r-- | gnu/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch | 233 | ||||
| -rw-r--r-- | gnu/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch | 245 |
5 files changed, 12 insertions, 485 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 3d79d5d22d..b1ff72d6a6 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -888,8 +888,6 @@ dist_patch_DATA = \ %D%/packages/patches/ola-readdir-r.patch \ %D%/packages/patches/openscenegraph-ffmpeg3.patch \ %D%/packages/patches/openexr-missing-samples.patch \ - %D%/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch \ - %D%/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch \ %D%/packages/patches/openldap-CVE-2017-9287.patch \ %D%/packages/patches/openocd-nrf52.patch \ %D%/packages/patches/openssl-runpath.patch \ diff --git a/gnu/packages/gstreamer.scm b/gnu/packages/gstreamer.scm index 69b8ffabee..97fd52e160 100644 --- a/gnu/packages/gstreamer.scm +++ b/gnu/packages/gstreamer.scm @@ -275,7 +275,16 @@ developers consider to have good quality code and correct functionality.") #:configure-flags (list (string-append "--with-html-dir=" (assoc-ref %outputs "doc") - "/share/gtk-doc/html")))) + "/share/gtk-doc/html")) + #:phases + (modify-phases %standard-phases + (add-after 'unpack 'patch-openjpeg-reference + (lambda _ + ;; Remove hard-coded openjpeg-2.1 path. 2.2 is API- and + ;; ABI-compatible. + (substitute* "ext/openjpeg/gstopenjpeg.h" + (("<openjpeg-2\\.1/") "<openjpeg-2.2/")) + #t))))) (propagated-inputs `(("gst-plugins-base" ,gst-plugins-base))) (native-inputs diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm index 63e3fa5049..95a4c91b10 100644 --- a/gnu/packages/image.scm +++ b/gnu/packages/image.scm @@ -511,7 +511,7 @@ work.") (define-public openjpeg (package (name "openjpeg") - (version "2.1.2") + (version "2.2.0") (source (origin (method url-fetch) @@ -521,9 +521,7 @@ work.") (file-name (string-append name "-" version ".tar.gz")) (sha256 (base32 - "19yz4g0c45sm8y1z01j9djsrl1mkz3pmw7fykc6hkvrqymp7prsc")) - (patches (search-patches "openjpeg-CVE-2016-9850-CVE-2016-9851.patch" - "openjpeg-CVE-2016-9572-CVE-2016-9573.patch")))) + "0yvfghxwfm3dcqr9krkw63pcd76hzkknc3fh7bh11s8qlvjvrpbg")))) (build-system cmake-build-system) (arguments ;; Trying to run `$ make check' results in a no rule fault. diff --git a/gnu/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch b/gnu/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch deleted file mode 100644 index 545b5d0a71..0000000000 --- a/gnu/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch +++ /dev/null @@ -1,233 +0,0 @@ -Fix CVE-2016-9572 and CVE-2016-9573: - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9572 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9573 -https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9572 -https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9573 - -Patch copied from 3rd-party repository: - -https://github.com/szukw000/openjpeg/commit/7b28bd2b723df6be09fe7791eba33147c1c47d0d - -From 7b28bd2b723df6be09fe7791eba33147c1c47d0d Mon Sep 17 00:00:00 2001 -From: szukw000 <szukw000@arcor.de> -Date: Mon, 28 Nov 2016 21:57:20 +0100 -Subject: [PATCH] Changes for issues #863 and #862 - ---- - src/bin/jp2/convert.c | 59 +++++++++++++++++++++++++++++++++++++++----- - src/bin/jp2/convertbmp.c | 29 +++++++++++++++++++++- - src/bin/jp2/opj_decompress.c | 2 +- - src/lib/openjp2/j2k.c | 11 ++++++--- - 4 files changed, 90 insertions(+), 11 deletions(-) - -diff --git a/src/bin/jp2/convert.c b/src/bin/jp2/convert.c -index deee4f6..6a3f65b 100644 ---- a/src/bin/jp2/convert.c -+++ b/src/bin/jp2/convert.c -@@ -906,7 +906,8 @@ int imagetotga(opj_image_t * image, const char *outfile) { - for (i = 0; i < image->numcomps-1; i++) { - if ((image->comps[0].dx != image->comps[i+1].dx) - ||(image->comps[0].dy != image->comps[i+1].dy) -- ||(image->comps[0].prec != image->comps[i+1].prec)) { -+ ||(image->comps[0].prec != image->comps[i+1].prec) -+ ||(image->comps[0].sgnd != image->comps[i+1].sgnd)) { - fclose(fdest); - fprintf(stderr, "Unable to create a tga file with such J2K image charateristics."); - return 1; -@@ -1743,7 +1744,7 @@ int imagetopnm(opj_image_t * image, const char *outfile, int force_split) - int *red, *green, *blue, *alpha; - int wr, hr, max; - int i; -- unsigned int compno, ncomp; -+ unsigned int compno, ncomp, ui; - int adjustR, adjustG, adjustB, adjustA; - int fails, two, want_gray, has_alpha, triple; - int prec, v; -@@ -1768,6 +1769,27 @@ int imagetopnm(opj_image_t * image, const char *outfile, int force_split) - - if(want_gray) ncomp = 1; - -+ for (ui = 1; ui < ncomp; ++ui) { -+ if (image->comps[0].dx != image->comps[ui].dx) { -+ break; -+ } -+ if (image->comps[0].dy != image->comps[ui].dy) { -+ break; -+ } -+ if (image->comps[0].prec != image->comps[ui].prec) { -+ break; -+ } -+ if (image->comps[0].sgnd != image->comps[ui].sgnd) { -+ break; -+ } -+ } -+ if (ui != ncomp) { -+ fprintf(stderr,"imagetopnm: All components\n shall have " -+ "the same subsampling, same bit depth, same sign.\n" -+ " Aborting\n"); -+ return 1; -+ } -+ - if ((force_split == 0) && - (ncomp == 2 /* GRAYA */ - || (ncomp > 2 /* RGB, RGBA */ -@@ -2126,7 +2148,7 @@ static int imagetoraw_common(opj_image_t * image, const char *outfile, OPJ_BOOL - { - FILE *rawFile = NULL; - size_t res; -- unsigned int compno; -+ unsigned int compno, numcomps; - int w, h, fails; - int line, row, curr, mask; - int *ptr; -@@ -2139,6 +2161,31 @@ static int imagetoraw_common(opj_image_t * image, const char *outfile, OPJ_BOOL - return 1; - } - -+ numcomps = image->numcomps; -+ -+ if (numcomps > 4) { -+ numcomps = 4; -+ } -+ for (compno = 1; compno < numcomps; ++compno) { -+ if (image->comps[0].dx != image->comps[compno].dx) { -+ break; -+ } -+ if (image->comps[0].dy != image->comps[compno].dy) { -+ break; -+ } -+ if (image->comps[0].prec != image->comps[compno].prec) { -+ break; -+ } -+ if (image->comps[0].sgnd != image->comps[compno].sgnd) { -+ break; -+ } -+ } -+ if (compno != numcomps) { -+ fprintf(stderr,"imagetoraw_common: All components shall have the same subsampling, same bit depth, same sign.\n"); -+ fprintf(stderr,"\tAborting\n"); -+ return 1; -+ } -+ - rawFile = fopen(outfile, "wb"); - if (!rawFile) { - fprintf(stderr, "Failed to open %s for writing !!\n", outfile); -@@ -2146,9 +2193,9 @@ static int imagetoraw_common(opj_image_t * image, const char *outfile, OPJ_BOOL - } - - fails = 1; -- fprintf(stdout,"Raw image characteristics: %d components\n", image->numcomps); -+ fprintf(stdout,"Raw image characteristics: %d components\n", numcomps); - -- for(compno = 0; compno < image->numcomps; compno++) -+ for(compno = 0; compno < numcomps; compno++) - { - fprintf(stdout,"Component %u characteristics: %dx%dx%d %s\n", compno, image->comps[compno].w, - image->comps[compno].h, image->comps[compno].prec, image->comps[compno].sgnd==1 ? "signed": "unsigned"); -@@ -2238,7 +2285,7 @@ static int imagetoraw_common(opj_image_t * image, const char *outfile, OPJ_BOOL - } - else if (image->comps[compno].prec <= 32) - { -- fprintf(stderr,"More than 16 bits per component no handled yet\n"); -+ fprintf(stderr,"More than 16 bits per component not handled yet\n"); - goto fin; - } - else -diff --git a/src/bin/jp2/convertbmp.c b/src/bin/jp2/convertbmp.c -index ae83077..8017ba8 100644 ---- a/src/bin/jp2/convertbmp.c -+++ b/src/bin/jp2/convertbmp.c -@@ -806,8 +806,35 @@ int imagetobmp(opj_image_t * image, const char *outfile) { - FILE *fdest = NULL; - int adjustR, adjustG, adjustB; - -+ { -+ unsigned int ui, ncomp = image->numcomps; -+ -+ if (ncomp > 4) { /* RGBA in bmpmask32toimage */ -+ ncomp = 4; -+ } -+ for (ui = 1; ui < ncomp; ++ui) { -+ if (image->comps[0].dx != image->comps[ui].dx) { -+ break; -+ } -+ if (image->comps[0].dy != image->comps[ui].dy) { -+ break; -+ } -+ if (image->comps[0].prec != image->comps[ui].prec) { -+ break; -+ } -+ if (image->comps[0].sgnd != image->comps[ui].sgnd) { -+ break; -+ } -+ } -+ if (ui != ncomp) { -+ fprintf(stderr,"imagetobmp: All components shall have the same subsampling, same bit depth, same sign.\n"); -+ fprintf(stderr,"\tAborting\n"); -+ return 1; -+ } -+ -+ } - if (image->comps[0].prec < 8) { -- fprintf(stderr, "Unsupported number of components: %d\n", image->comps[0].prec); -+ fprintf(stderr, "imagetobmp: Unsupported precision: %d\n", image->comps[0].prec); - return 1; - } - if (image->numcomps >= 3 && image->comps[0].dx == image->comps[1].dx -diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c -index 83160c3..c30079b 100644 ---- a/src/bin/jp2/opj_decompress.c -+++ b/src/bin/jp2/opj_decompress.c -@@ -1607,7 +1607,7 @@ int main(int argc, char **argv) - if(dirptr->filename_buf) free(dirptr->filename_buf); - free(dirptr); - } -- if (numDecompressedImages) { -+ if (numDecompressedImages && !failed) { - fprintf(stdout, "decode time: %d ms\n", (int)( (tCumulative * 1000.0) / (OPJ_FLOAT64)numDecompressedImages)); - } - return failed ? EXIT_FAILURE : EXIT_SUCCESS; -diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c -index 66802bb..b6daa32 100644 ---- a/src/lib/openjp2/j2k.c -+++ b/src/lib/openjp2/j2k.c -@@ -2158,7 +2158,7 @@ static OPJ_BOOL opj_j2k_read_siz(opj_j2k_t *p_j2k, - i, l_img_comp->dx, l_img_comp->dy); - return OPJ_FALSE; - } -- if( l_img_comp->prec > 38) { /* TODO openjpeg won't handle more than ? */ -+ if( l_img_comp->prec < 1 || l_img_comp->prec > 38) { /* TODO openjpeg won't handle more than ? */ - opj_event_msg(p_manager, EVT_ERROR, - "Invalid values for comp = %d : prec=%u (should be between 1 and 38 according to the JPEG2000 norm)\n", - i, l_img_comp->prec); -@@ -10029,7 +10029,11 @@ OPJ_BOOL opj_j2k_decode(opj_j2k_t * p_j2k, - /* Move data and copy one information from codec to output image*/ - for (compno = 0; compno < p_image->numcomps; compno++) { - p_image->comps[compno].resno_decoded = p_j2k->m_output_image->comps[compno].resno_decoded; -- p_image->comps[compno].data = p_j2k->m_output_image->comps[compno].data; -+ p_image->comps[compno].data = p_j2k->m_output_image->comps[compno].data; -+ -+ if(p_image->comps[compno].data == NULL) return OPJ_FALSE; -+ -+ p_j2k->m_output_image->comps[compno].data = NULL; - #if 0 - char fn[256]; - sprintf( fn, "/tmp/%d.raw", compno ); -@@ -10037,7 +10041,6 @@ OPJ_BOOL opj_j2k_decode(opj_j2k_t * p_j2k, - fwrite( p_image->comps[compno].data, sizeof(OPJ_INT32), p_image->comps[compno].w * p_image->comps[compno].h, debug ); - fclose( debug ); - #endif -- p_j2k->m_output_image->comps[compno].data = NULL; - } - - return OPJ_TRUE; -@@ -10131,6 +10134,8 @@ OPJ_BOOL opj_j2k_get_tile( opj_j2k_t *p_j2k, - - p_image->comps[compno].data = p_j2k->m_output_image->comps[compno].data; - -+ if (p_image->comps[compno].data == NULL) return OPJ_FALSE; -+ - p_j2k->m_output_image->comps[compno].data = NULL; - } - diff --git a/gnu/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch b/gnu/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch deleted file mode 100644 index 3f637fa88b..0000000000 --- a/gnu/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch +++ /dev/null @@ -1,245 +0,0 @@ -From cadff5fb6e73398de26a92e96d3d7cac893af255 Mon Sep 17 00:00:00 2001 -From: szukw000 <szukw000@arcor.de> -Date: Fri, 9 Dec 2016 08:29:55 +0100 -Subject: [PATCH] These changes repair bugs of #871 and #872 - -email from http://openwall.com/lists/oss-security/2016/12/09/4 -patch is against openjpeg-2.1.2, applies cleanly to 2.1.1. - ---- - src/bin/jp2/converttif.c | 107 +++++++++++++++++++++++++++++++---------------- - 1 file changed, 70 insertions(+), 37 deletions(-) - -diff --git a/src/bin/jp2/converttif.c b/src/bin/jp2/converttif.c -index 143d3be..c690f8b 100644 ---- a/src/bin/jp2/converttif.c -+++ b/src/bin/jp2/converttif.c -@@ -553,20 +553,18 @@ static void tif_32sto16u(const OPJ_INT32* pSrc, OPJ_UINT16* pDst, OPJ_SIZE_T len - - int imagetotif(opj_image_t * image, const char *outfile) - { -- int width, height; -- int bps,adjust, sgnd; -- int tiPhoto; -+ uint32 width, height, bps, tiPhoto; -+ int adjust, sgnd; - TIFF *tif; - tdata_t buf; -- tsize_t strip_size; -+ tmsize_t strip_size, rowStride; - OPJ_UINT32 i, numcomps; -- OPJ_SIZE_T rowStride; - OPJ_INT32* buffer32s = NULL; - OPJ_INT32 const* planes[4]; - convert_32s_PXCX cvtPxToCx = NULL; - convert_32sXXx_C1R cvt32sToTif = NULL; - -- bps = (int)image->comps[0].prec; -+ bps = (uint32)image->comps[0].prec; - planes[0] = image->comps[0].data; - - numcomps = image->numcomps; -@@ -674,13 +672,13 @@ int imagetotif(opj_image_t * image, const char *outfile) - break; - } - sgnd = (int)image->comps[0].sgnd; -- adjust = sgnd ? 1 << (image->comps[0].prec - 1) : 0; -- width = (int)image->comps[0].w; -- height = (int)image->comps[0].h; -+ adjust = sgnd ? (int)(1 << (image->comps[0].prec - 1)) : 0; -+ width = (uint32)image->comps[0].w; -+ height = (uint32)image->comps[0].h; - - TIFFSetField(tif, TIFFTAG_IMAGEWIDTH, width); - TIFFSetField(tif, TIFFTAG_IMAGELENGTH, height); -- TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, numcomps); -+ TIFFSetField(tif, TIFFTAG_SAMPLESPERPIXEL, (uint32)numcomps); - TIFFSetField(tif, TIFFTAG_BITSPERSAMPLE, bps); - TIFFSetField(tif, TIFFTAG_ORIENTATION, ORIENTATION_TOPLEFT); - TIFFSetField(tif, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG); -@@ -688,8 +686,8 @@ int imagetotif(opj_image_t * image, const char *outfile) - TIFFSetField(tif, TIFFTAG_ROWSPERSTRIP, 1); - - strip_size = TIFFStripSize(tif); -- rowStride = ((OPJ_SIZE_T)width * numcomps * (OPJ_SIZE_T)bps + 7U) / 8U; -- if (rowStride != (OPJ_SIZE_T)strip_size) { -+ rowStride = (width * numcomps * bps + 7U) / 8U; -+ if (rowStride != strip_size) { - fprintf(stderr, "Invalid TIFF strip size\n"); - TIFFClose(tif); - return 1; -@@ -699,7 +697,7 @@ int imagetotif(opj_image_t * image, const char *outfile) - TIFFClose(tif); - return 1; - } -- buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)width * numcomps * sizeof(OPJ_INT32)); -+ buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(width * numcomps * sizeof(OPJ_INT32))); - if (buffer32s == NULL) { - _TIFFfree(buf); - TIFFClose(tif); -@@ -1211,20 +1209,19 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - TIFF *tif; - tdata_t buf; - tstrip_t strip; -- tsize_t strip_size; -+ tmsize_t strip_size; - int j, currentPlane, numcomps = 0, w, h; - OPJ_COLOR_SPACE color_space = OPJ_CLRSPC_UNKNOWN; - opj_image_cmptparm_t cmptparm[4]; /* RGBA */ - opj_image_t *image = NULL; - int has_alpha = 0; -- unsigned short tiBps, tiPhoto, tiSf, tiSpp, tiPC; -- unsigned int tiWidth, tiHeight; -+ uint32 tiBps, tiPhoto, tiSf, tiSpp, tiPC, tiWidth, tiHeight; - OPJ_BOOL is_cinema = OPJ_IS_CINEMA(parameters->rsiz); - convert_XXx32s_C1R cvtTifTo32s = NULL; - convert_32s_CXPX cvtCxToPx = NULL; - OPJ_INT32* buffer32s = NULL; - OPJ_INT32* planes[4]; -- OPJ_SIZE_T rowStride; -+ tmsize_t rowStride; - - tif = TIFFOpen(filename, "r"); - -@@ -1243,22 +1240,35 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &tiSpp); - TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, &tiPhoto); - TIFFGetField(tif, TIFFTAG_PLANARCONFIG, &tiPC); -- w= (int)tiWidth; -- h= (int)tiHeight; -- -- if(tiBps > 16U) { -- fprintf(stderr,"tiftoimage: Bits=%d, Only 1 to 16 bits implemented\n",tiBps); -- fprintf(stderr,"\tAborting\n"); -+ -+ if(tiSpp == 0 || tiSpp > 4) { /* should be 1 ... 4 */ -+ fprintf(stderr,"tiftoimage: Bad value for samples per pixel == %hu.\n" -+ "\tAborting.\n", tiSpp); -+ TIFFClose(tif); -+ return NULL; -+ } -+ if(tiBps > 16U || tiBps == 0) { -+ fprintf(stderr,"tiftoimage: Bad values for Bits == %d.\n" -+ "\tMax. 16 Bits are allowed here.\n\tAborting.\n",tiBps); - TIFFClose(tif); - return NULL; - } - if(tiPhoto != PHOTOMETRIC_MINISBLACK && tiPhoto != PHOTOMETRIC_RGB) { -- fprintf(stderr,"tiftoimage: Bad color format %d.\n\tOnly RGB(A) and GRAY(A) has been implemented\n",(int) tiPhoto); -+ fprintf(stderr,"tiftoimage: Bad color format %d.\n" -+ "\tOnly RGB(A) and GRAY(A) has been implemented\n",(int) tiPhoto); - fprintf(stderr,"\tAborting\n"); - TIFFClose(tif); - return NULL; - } -- -+ if(tiWidth == 0 || tiHeight == 0) { -+ fprintf(stderr,"tiftoimage: Bad values for width(%u) " -+ "and/or height(%u)\n\tAborting.\n",tiWidth,tiHeight); -+ TIFFClose(tif); -+ return NULL; -+ } -+ w= (int)tiWidth; -+ h= (int)tiHeight; -+ - switch (tiBps) { - case 1: - case 2: -@@ -1312,7 +1322,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - - TIFFGetFieldDefaulted(tif, TIFFTAG_EXTRASAMPLES, - &extrasamples, &sampleinfo); -- -+ - if(extrasamples >= 1) - { - switch(sampleinfo[0]) -@@ -1333,7 +1343,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - else /* extrasamples == 0 */ - if(tiSpp == 4 || tiSpp == 2) has_alpha = 1; - } -- -+ - /* initialize image components */ - memset(&cmptparm[0], 0, 4 * sizeof(opj_image_cmptparm_t)); - -@@ -1346,7 +1356,7 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - } else { - is_cinema = 0U; - } -- -+ - if(tiPhoto == PHOTOMETRIC_RGB) /* RGB(A) */ - { - numcomps = 3 + has_alpha; -@@ -1384,10 +1394,24 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - image->x0 = (OPJ_UINT32)parameters->image_offset_x0; - image->y0 = (OPJ_UINT32)parameters->image_offset_y0; - image->x1 = !image->x0 ? (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1 : -- image->x0 + (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1; -+ image->x0 + (OPJ_UINT32)(w - 1) * (OPJ_UINT32)subsampling_dx + 1; -+ if(image->x1 <= image->x0) { -+ fprintf(stderr,"tiftoimage: Bad value for image->x1(%d) vs. " -+ "image->x0(%d)\n\tAborting.\n",image->x1,image->x0); -+ TIFFClose(tif); -+ opj_image_destroy(image); -+ return NULL; -+ } - image->y1 = !image->y0 ? (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1 : -- image->y0 + (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1; -- -+ image->y0 + (OPJ_UINT32)(h - 1) * (OPJ_UINT32)subsampling_dy + 1; -+ if(image->y1 <= image->y0) { -+ fprintf(stderr,"tiftoimage: Bad value for image->y1(%d) vs. " -+ "image->y0(%d)\n\tAborting.\n",image->y1,image->y0); -+ TIFFClose(tif); -+ opj_image_destroy(image); -+ return NULL; -+ } -+ - for(j = 0; j < numcomps; j++) - { - planes[j] = image->comps[j].data; -@@ -1395,15 +1419,15 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - image->comps[numcomps - 1].alpha = (OPJ_UINT16)(1 - (numcomps & 1)); - - strip_size = TIFFStripSize(tif); -- -+ - buf = _TIFFmalloc(strip_size); - if (buf == NULL) { - TIFFClose(tif); - opj_image_destroy(image); - return NULL; - } -- rowStride = ((OPJ_SIZE_T)w * tiSpp * tiBps + 7U) / 8U; -- buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)w * tiSpp * sizeof(OPJ_INT32)); -+ rowStride = (w * tiSpp * tiBps + 7U) / 8U; -+ buffer32s = (OPJ_INT32 *)malloc((OPJ_SIZE_T)(w * tiSpp * sizeof(OPJ_INT32))); - if (buffer32s == NULL) { - _TIFFfree(buf); - TIFFClose(tif); -@@ -1421,11 +1445,20 @@ opj_image_t* tiftoimage(const char *filename, opj_cparameters_t *parameters) - for(; (h > 0) && (strip < TIFFNumberOfStrips(tif)); strip++) - { - const OPJ_UINT8 *dat8; -- OPJ_SIZE_T ssize; -+ tmsize_t ssize; - -- ssize = (OPJ_SIZE_T)TIFFReadEncodedStrip(tif, strip, buf, strip_size); -+ ssize = TIFFReadEncodedStrip(tif, strip, buf, strip_size); -+ if(ssize < 1 || ssize > strip_size) { -+ fprintf(stderr,"tiftoimage: Bad value for ssize(%ld) " -+ "vs. strip_size(%ld).\n\tAborting.\n",ssize,strip_size); -+ _TIFFfree(buf); -+ _TIFFfree(buffer32s); -+ TIFFClose(tif); -+ opj_image_destroy(image); -+ return NULL; -+ } - dat8 = (const OPJ_UINT8*)buf; -- -+ - while (ssize >= rowStride) { - cvtTifTo32s(dat8, buffer32s, (OPJ_SIZE_T)w * tiSpp); - cvtCxToPx(buffer32s, planes, (OPJ_SIZE_T)w); |