Skip to content
This repository has been archived by the owner on Jul 29, 2020. It is now read-only.

Commit

Permalink
Fix integer width in jpc_math
Browse files Browse the repository at this point in the history
Fix denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Assigned CVE-2018-9055.
Fixes jasper-software/jasper#172.

Fix by Fridrich Strba <FStrba@suse.com>.

See: jasper-software/jasper#204
Fix #9
  • Loading branch information
jubalh committed Jun 15, 2020
1 parent 9aef6d9 commit ecc98d6
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 4 deletions.
4 changes: 2 additions & 2 deletions src/libjasper/jpc/jpc_math.c
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@

/* Calculate the integer quantity floor(log2(x)), where x is a positive
integer. */
int jpc_floorlog2(int x)
int jpc_floorlog2(int_fast32_t x)
{
int y;

Expand All @@ -105,7 +105,7 @@ int jpc_floorlog2(int x)
integer. */
/* This function is the basically the same as ceillog2(x), except that the
allowable range for x is slightly different. */
int jpc_firstone(int x)
int jpc_firstone(int_fast32_t x)
{
int n;

Expand Down
5 changes: 3 additions & 2 deletions src/libjasper/jpc/jpc_math.h
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,7 @@
\******************************************************************************/

#include <assert.h>
#include <stdint.h>

/******************************************************************************\
* Macros
Expand All @@ -90,10 +91,10 @@

/* Calculate the bit position of the first leading one in a nonnegative
integer. */
int jpc_firstone(int x);
int jpc_firstone(int_fast32_t x);

/* Calculate the integer quantity floor(log2(x)), where x is a positive
integer. */
int jpc_floorlog2(int x);
int jpc_floorlog2(int_fast32_t x);

#endif

0 comments on commit ecc98d6

Please sign in to comment.