Revised to address int overflow in for loop only

Eharve14 · Jan 13, 2022 · e74ee84 · e74ee84
1 parent 85b471f
commit e74ee84
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 22 deletions.
diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c
@@ -1957,11 +1957,6 @@ int main(int argc, char **argv)
     /* Read directory if necessary */
     if (img_fol.set_imgdir == 1) {
         num_images = get_num_images(img_fol.imgdirpath);
-        if((num_images > SIZE_MAX/(OPJ_PATH_LEN * sizeof(char)))){
-            fprintf(stdout, "Max images exceeded\n");
-            ret = 0;
-            goto fin;
-        } else {
         dirptr = (dircnt_t*)malloc(sizeof(dircnt_t));
         if (dirptr) {
             dirptr->filename_buf = (char*)calloc(num_images, OPJ_PATH_LEN * sizeof(
@@ -1971,15 +1966,14 @@ int main(int argc, char **argv)
                 ret = 0;
                 goto fin;
             }
-            for (i = 0; i < num_images; i++) {
+            for (size_t i = 0; i < num_images; i++) {
                 dirptr->filename[i] = dirptr->filename_buf + i * OPJ_PATH_LEN;
             }
         }
         if (load_images(dirptr, img_fol.imgdirpath) == 1) {
             ret = 0;
             goto fin;
         }
-        }
         if (num_images == 0) {
             fprintf(stdout, "Folder is empty\n");
             ret = 0;

diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c
@@ -1365,13 +1365,7 @@ int main(int argc, char **argv)
 
     /* Initialize reading of directory */
     if (img_fol.set_imgdir == 1) {
-        int it_image;
         num_images = get_num_images(img_fol.imgdirpath);
-        if( num_images > SIZE_MAX/(sizeof(char)* OPJ_PATH_LEN)){
-             fprintf(stderr, "Max number of images exceeded\n");
-             failed = 1;
-             goto fin;
-        } else {
         dirptr = (dircnt_t*)calloc(1, sizeof(dircnt_t));
         if (!dirptr) {
             destroy_parameters(&parameters);
@@ -1390,15 +1384,14 @@ int main(int argc, char **argv)
             failed = 1;
             goto fin;
         }
-        for (it_image = 0; it_image < num_images; it_image++) {
+        for (size_t it_image = 0; it_image < num_images; it_image++) {
             dirptr->filename[it_image] = dirptr->filename_buf + it_image * OPJ_PATH_LEN;
         }
 
         if (load_images(dirptr, img_fol.imgdirpath) == 1) {
             failed = 1;
             goto fin;
         }
-        }
         if (num_images == 0) {
             fprintf(stderr, "Folder is empty\n");
             failed = 1;

diff --git a/src/bin/jp2/opj_dump.c b/src/bin/jp2/opj_dump.c
@@ -508,18 +508,13 @@ int main(int argc, char *argv[])
 
     /* Initialize reading of directory */
     if (img_fol.set_imgdir == 1) {
-        int it_image;
         num_images = get_num_images(img_fol.imgdirpath);
 
         dirptr = (dircnt_t*)malloc(sizeof(dircnt_t));
         if (!dirptr) {
             return EXIT_FAILURE;
         }
         /* Stores at max 10 image file names*/
-        if(num_images> SIZE_MAX/(OPJ_PATH_LEN * sizeof(char))){
-            free(dirptr);
-            return EXIT_FAILURE;
-        }else{
         dirptr->filename_buf = (char*) calloc((size_t) num_images,
                                               OPJ_PATH_LEN * sizeof(char));
         if (!dirptr->filename_buf) {
@@ -532,14 +527,13 @@ int main(int argc, char *argv[])
             goto fails;
         }
 
-        for (it_image = 0; it_image < num_images; it_image++) {
+        for (size_t it_image = 0; it_image < num_images; it_image++) {
             dirptr->filename[it_image] = dirptr->filename_buf + it_image * OPJ_PATH_LEN;
         }
 
         if (load_images(dirptr, img_fol.imgdirpath) == 1) {
             goto fails;
         }
-        }
         if (num_images == 0) {
             fprintf(stdout, "Folder is empty\n");
             goto fails;