shithub: jbig2

Info  •  Files  •  Log  •  Branches

jbig2dec: Fix OSS-Fuzz issue 20505.

Previous code could overflow if w >= 2^32 - 32, breaking behaviour of 'if'
statements and causing incorrect behaviour (including assert failures).

The fix is due to sebras - change expressions such as (x + 32 > w) to (w - x <
32) to avoid overflow for very large w. (We know at all times that x <= w.)

Thanks for OSS-Fuzz for reporting.

--- a/jbig2_mmr.c

+++ b/jbig2_mmr.c

@@ -801,7 +801,7 @@

     assert(x % 8 == 0);

     /* Check next uint8 if we are not on 16-bit boundary. */

     if (x % 16) {

-        if (x + 8 > w) {

+        if (w - x < 8) {

             goto check1;

         }

         if ( ((uint8_t*) line)[ x / 8] != all8) {

@@ -813,7 +813,7 @@

     assert(x % 16 == 0);

     /* Check next uint16 if we are not on 32-bit boundary. */

     if (x % 32) {

-        if (x + 16 > w) {

+        if (w - x < 16) {

             goto check8;

         }

         if ( ((uint16_t*) line)[ x / 16] != all16) {

@@ -826,7 +826,7 @@

     sub-32-bit region. */

     assert(x % 32 == 0);

     for(;;) {

-        if (x + 32 > w) {

+        if (w - x < 32) {

             /* We could still look at the uint32 here - if it equals all32, we

             know there is no match before <w> so could do {x = w; goto end;}.

@@ -843,11 +843,11 @@

     /* Check next uint16. */

 check16:

     assert(x % 16 == 0);

-    if (x + 16 > w) {

+    if (w - x < 16) {

         goto check8;

     }

 check16_no_eof:

-    assert(x + 16 <= w);

+    assert(w - x >= 16);

     if ( ((uint16_t*) line)[x/16] != all16) {

         goto check8_no_eof;

     }

@@ -856,11 +856,11 @@

     /* Check next uint8. */

 check8:

     assert(x % 8 == 0);

-    if (x + 8 > w) {

+    if (w - x < 8) {

         goto check1;

     }

 check8_no_eof:

-    assert(x + 8 <= w);

+    assert(w - x >= 8);

     if ( ((uint8_t*) line)[x/8] != all8) {

         goto check1;

     }