Skip to content

Commit 46822d0

Browse files
committed
[JPWL] imagetotga(): fix read heap buffer overflow if numcomps < 3 (#987)
Signed-off-by: Young_X <YangX92@hotmail.com>
1 parent 619e1b0 commit 46822d0

1 file changed

Lines changed: 5 additions & 3 deletions

File tree

src/bin/jpwl/convert.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -445,7 +445,7 @@ int imagetotga(opj_image_t * image, const char *outfile)
445445
{
446446
int width, height, bpp, x, y;
447447
opj_bool write_alpha;
448-
int i, adjustR, adjustG, adjustB;
448+
int i, adjustR, adjustG = 0, adjustB = 0;
449449
unsigned int alpha_channel;
450450
float r, g, b, a;
451451
unsigned char value;
@@ -486,8 +486,10 @@ int imagetotga(opj_image_t * image, const char *outfile)
486486
scale = 255.0f / (float)((1 << image->comps[0].prec) - 1);
487487

488488
adjustR = (image->comps[0].sgnd ? 1 << (image->comps[0].prec - 1) : 0);
489-
adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0);
490-
adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0);
489+
if (image->numcomps >= 3) {
490+
adjustG = (image->comps[1].sgnd ? 1 << (image->comps[1].prec - 1) : 0);
491+
adjustB = (image->comps[2].sgnd ? 1 << (image->comps[2].prec - 1) : 0);
492+
}
491493

492494
for (y = 0; y < height; y++) {
493495
unsigned int index = y * width;

0 commit comments

Comments
 (0)