Skip to content

fix(jpeg2000): Watch out for int overflow in buffer size computation#5143

Merged
lgritz merged 2 commits intoAcademySoftwareFoundation:mainfrom
lgritz:lg-j2k
Apr 23, 2026
Merged

fix(jpeg2000): Watch out for int overflow in buffer size computation#5143
lgritz merged 2 commits intoAcademySoftwareFoundation:mainfrom
lgritz:lg-j2k

Conversation

@lgritz
Copy link
Copy Markdown
Collaborator

@lgritz lgritz commented Apr 12, 2026

No description provided.

Signed-off-by: Larry Gritz <lg@larrygritz.com>
@lgritz lgritz added bug Crash or wrong behavior of an existing feature. file formats Image file formats, ImageInput, ImageOutput labels Apr 14, 2026
@lgritz
Copy link
Copy Markdown
Collaborator Author

lgritz commented Apr 18, 2026

This is a week old. Any comments or objections?

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to prevent integer overflow when computing the pixel buffer size for JPEG2000 (OpenJPH) image reads.

Changes:

  • Changes the buffer size computation in ojph_read_image() from int arithmetic to size_t arithmetic.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/jpeg2000.imageio/jpeg2000input.cpp Outdated
Signed-off-by: Larry Gritz <lg@larrygritz.com>
@lgritz
Copy link
Copy Markdown
Collaborator Author

lgritz commented Apr 22, 2026

Because I just modified this PR slightly, I will give more time to receive comments. But because it's gone 10 days without objections on everything but the 4 statements I just added, I'm giving it just one more full day. I want to get this merged with plenty of time to be included in the May 1 patch release.

@lgritz lgritz merged commit 0e43845 into AcademySoftwareFoundation:main Apr 23, 2026
30 checks passed
lgritz added a commit to lgritz/OpenImageIO that referenced this pull request Apr 23, 2026
lgritz added a commit to lgritz/OpenImageIO that referenced this pull request Apr 23, 2026
@lgritz lgritz deleted the lg-j2k branch April 23, 2026 15:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Crash or wrong behavior of an existing feature. file formats Image file formats, ImageInput, ImageOutput

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants