From 994f937f8709502cb01a33c1a842662226569fd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nikola=20Forr=C3=B3?= Date: Wed, 8 Feb 2017 16:16:44 +0100 Subject: [PATCH] Fix Coverity issues --- libopenjpeg/jp2.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libopenjpeg/jp2.c b/libopenjpeg/jp2.c index afa4449..c3740eb 100644 --- a/libopenjpeg/jp2.c +++ b/libopenjpeg/jp2.c @@ -443,6 +443,7 @@ static opj_bool jp2_read_pclr(opj_jp2_t *jp2, opj_cio_t *cio, unsigned short nr_entries, nr_channels; unsigned short i, j; unsigned char uc; + size_t entries_size; OPJ_ARG_NOT_USED(box); OPJ_ARG_NOT_USED(jp2); @@ -455,8 +456,13 @@ static opj_bool jp2_read_pclr(opj_jp2_t *jp2, opj_cio_t *cio, nr_entries = (unsigned short)cio_read(cio, 2); /* NE */ nr_channels = (unsigned short)cio_read(cio, 1);/* NPC */ - entries = (unsigned int*) - opj_malloc(nr_channels * nr_entries * sizeof(unsigned int)); + /* check for overflow */ + entries_size = (size_t) nr_entries * nr_channels * sizeof(unsigned int); + if ( nr_entries != 0 && entries_size / sizeof(unsigned int) / nr_entries != nr_channels) { + return OPJ_FALSE; + } + + entries = (unsigned int*)opj_malloc(entries_size); channel_size = (unsigned char*)opj_malloc(nr_channels); channel_sign = (unsigned char*)opj_malloc(nr_channels); -- 2.7.4