opj_t2_read_packet_header(): fix unsigned-integer-overflow at t2.c:12…

…34 (#1488)
uclouvain · Dec 8, 2023 · c0eb25d · c0eb25d
1 parent b0e83a1
commit c0eb25d
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/src/lib/openjp2/t2.c b/src/lib/openjp2/t2.c
@@ -1231,7 +1231,13 @@ static OPJ_BOOL opj_t2_read_packet_header(opj_t2_t* p_t2,
                 }
 
                 l_cblk->Mb = (OPJ_UINT32)l_band->numbps;
-                l_cblk->numbps = (OPJ_UINT32)l_band->numbps + 1 - i;
+                if ((OPJ_UINT32)l_band->numbps + 1 < i) {
+                    /* We should probably error out but that would break */
+                    /* test case related to dwt_interleave_h.gsr105.jp2 */
+                    l_cblk->numbps = 0;
+                } else {
+                    l_cblk->numbps = (OPJ_UINT32)l_band->numbps + 1 - i;
+                }
                 l_cblk->numlenbits = 3;
             }