The following prevents the crash (this is for the 3.6.0. version):
Code:
Index: djcodecd.cc
===================================================================
--- djcodecd.cc (revision 5186)
+++ djcodecd.cc (working copy)
@@ -152,21 +152,26 @@
{
Uint32 frameSize = ((precision > 8) ? sizeof(Uint16) : sizeof(Uint8)) * imageRows * imageColumns * imageSamplesPerPixel;
Uint32 totalSize = frameSize * imageFrames;
+ if (totalSize/frameSize != imageFrames) // check for integer overflow
+ result = EC_MemoryExhausted;
if (totalSize & 1) totalSize++; // align on 16-bit word boundary
Uint16 *imageData16 = NULL;
Sint32 currentFrame = 0;
Uint32 currentItem = 1; // ignore offset table
- if (isYBR && (imageBitsStored < imageBitsAllocated)) // check for a special case that is currently not handled properly
+ if (result.good())
{
- if (djcp->getDecompressionColorSpaceConversion() != EDC_never)
+ if (isYBR && (imageBitsStored < imageBitsAllocated)) // check for a special case that is currently not handled properly
{
- DCMJPEG_WARN("BitsStored < BitsAllocated for JPEG compressed image with YCbCr color model, color space conversion will probably not work properly");
- DCMJPEG_DEBUG("workaround: use option --conv-never (for command line tools) or EDC_never (for the DJDecoderRegistration::registerCodecs() call)");
+ if (djcp->getDecompressionColorSpaceConversion() != EDC_never)
+ {
+ DCMJPEG_WARN("BitsStored < BitsAllocated for JPEG compressed image with YCbCr color model, color space conversion will probably not work properly");
+ DCMJPEG_DEBUG("workaround: use option --conv-never (for command line tools) or EDC_never (for the DJDecoderRegistration::registerCodecs() call)");
+ }
}
+
+ result = uncompressedPixelData.createUint16Array(totalSize / sizeof(Uint16), imageData16);
}
-
- result = uncompressedPixelData.createUint16Array(totalSize / sizeof(Uint16), imageData16);
if (result.good())
{
Uint8 *imageData8 = (Uint8 *)imageData16;