From 42e67511eccf44876aef17ffec26ff66230bde1c Mon Sep 17 00:00:00 2001 From: Larry Gritz Date: Sat, 11 Apr 2026 19:45:34 -0700 Subject: [PATCH 1/2] fix(jpeg2000): Watch out for int overflow in buffer size computation Signed-off-by: Larry Gritz --- src/jpeg2000.imageio/jpeg2000input.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/jpeg2000.imageio/jpeg2000input.cpp b/src/jpeg2000.imageio/jpeg2000input.cpp index bc08d397be..d7e6f17ec1 100644 --- a/src/jpeg2000.imageio/jpeg2000input.cpp +++ b/src/jpeg2000.imageio/jpeg2000input.cpp @@ -392,7 +392,8 @@ Jpeg2000Input::ojph_read_image() int ch = m_spec.nchannels; ojph::param_siz siz = codestream.access_siz(); - const int bufsize = w * h * ch * buffer_bpp; + const size_t bufsize = size_t(w) * size_t(h) * size_t(ch) + * size_t(buffer_bpp); m_buf.resize(bufsize); codestream.create(); From 4856690716bb246c7e0ee72e61104f55daf45dfb Mon Sep 17 00:00:00 2001 From: Larry Gritz Date: Tue, 21 Apr 2026 21:41:32 -0700 Subject: [PATCH 2/2] use check_open, and use clamped_mult64 to avoid possible overflow Signed-off-by: Larry Gritz --- src/jpeg2000.imageio/jpeg2000input.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/jpeg2000.imageio/jpeg2000input.cpp b/src/jpeg2000.imageio/jpeg2000input.cpp index d7e6f17ec1..3217fa631e 100644 --- a/src/jpeg2000.imageio/jpeg2000input.cpp +++ b/src/jpeg2000.imageio/jpeg2000input.cpp @@ -392,8 +392,9 @@ Jpeg2000Input::ojph_read_image() int ch = m_spec.nchannels; ojph::param_siz siz = codestream.access_siz(); - const size_t bufsize = size_t(w) * size_t(h) * size_t(ch) - * size_t(buffer_bpp); + const size_t bufsize + = clamped_mult64(clamped_mult64(uint64_t(w), uint64_t(h)), + clamped_mult64(uint64_t(ch), uint64_t(buffer_bpp))); m_buf.resize(bufsize); codestream.create(); @@ -623,6 +624,14 @@ Jpeg2000Input::open(const std::string& name, ImageSpec& p_spec) m_spec.full_width = m_image->x1; m_spec.full_height = m_image->y1; + // Validation of resolution + if (!check_open(m_spec, + { 0, std::numeric_limits::max(), 0, + std::numeric_limits::max(), 0, 1, 0, 16384 })) { + close(); + return false; + } + m_spec.attribute("oiio:BitsPerSample", maxPrecision); m_spec.set_colorspace("srgb_rec709_scene");