From 839936aa33eb8899bbbd80fda02796bb65068951 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sun, 5 Apr 2026 13:25:27 +0200 Subject: [PATCH] opj_pi_initialise_encode() (write code path): avoid potential integer overflow leading to insufficient memory allocation Fixes #1619 CVE: CVE-2026-6192 Upstream: https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951 Signed-off-by: Thomas Perale --- src/lib/openjp2/pi.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/lib/openjp2/pi.c b/src/lib/openjp2/pi.c index 15ac33142..4abb87af2 100644 --- a/src/lib/openjp2/pi.c +++ b/src/lib/openjp2/pi.c @@ -1694,9 +1694,12 @@ opj_pi_iterator_t *opj_pi_initialise_encode(const opj_image_t *p_image, l_current_pi = l_pi; /* memory allocation for include*/ - l_current_pi->include_size = l_tcp->numlayers * l_step_l; - l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, - sizeof(OPJ_INT16)); + l_current_pi->include = NULL; + if (l_step_l <= UINT_MAX / l_tcp->numlayers) { + l_current_pi->include_size = l_tcp->numlayers * l_step_l; + l_current_pi->include = (OPJ_INT16*) opj_calloc(l_current_pi->include_size, + sizeof(OPJ_INT16)); + } if (!l_current_pi->include) { opj_free(l_tmp_data); opj_free(l_tmp_ptr);