Merge pull request #944 from lovell/j2k-siz-segment-bounds

Ensure correct JPEG2000 SIZ segment bounds check
strukturag · Oct 4, 2023 · 09a2634 · 09a2634
2 parents 6635c50 + c6af00f
commit 09a2634
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/fuzzing/data/corpus/j2k-siz-segment-undersized.heic b/fuzzing/data/corpus/j2k-siz-segment-undersized.heic
diff --git a/libheif/jpeg2000.cc b/libheif/jpeg2000.cc
@@ -331,15 +331,15 @@ JPEG2000_SIZ_segment jpeg2000_get_SIZ_segment(const HeifFile& file, heif_item_id
  JPEG2000_SIZ_segment siz;
 
  // space for full header and one component
- if (i + 2 + 38 + 3 > data.size()) {
+ if (i + 2 + 40 + 3 > data.size()) {
  return {};
  }
 
  // read number of components
 
  int nComponents = read16(data, 40);
 
- if (i + 2 + 38 + nComponents * 3 > data.size()) {
+ if (i + 2 + 40 + nComponents * 3 > data.size()) {
  return {};
  }