From 6a3194c523e084614fcc3af8c7f02096cfdc9de1 Mon Sep 17 00:00:00 2001 From: iliasabk Date: Wed, 16 Sep 2026 15:34:41 +0200 Subject: [PATCH] Validate index range in jas_matrix_bindsub jas_matrix_bindsub used the caller-supplied row/column indices to index mat1->rows_ with no bounds checking, so an out-of-range index read past the rows_ pointer array (heap OOB read). The read pointer was then stored into mat0->rows_ and would be dereferenced by any later accessor. The public inline wrappers jas_matrix_bindrow and jas_matrix_bindcol forward caller indices directly, and unlike the sibling jas_seq2d_bindsub no validation happened on this path. Reject out-of-range or inverted ranges, and a mat1 without a row array, before mat0 is modified. Validation now happens first so a failed bind no longer frees mat0's data. Fixes jasper-software/jasper#419. --- src/libjasper/base/jas_seq.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/libjasper/base/jas_seq.c b/src/libjasper/base/jas_seq.c index 44fb67a4..f8427920 100644 --- a/src/libjasper/base/jas_seq.c +++ b/src/libjasper/base/jas_seq.c @@ -219,6 +219,11 @@ int jas_matrix_bindsub(jas_matrix_t *mat0, jas_matrix_t *mat1, { jas_matind_t i; + if (r0 < 0 || c0 < 0 || r0 > r1 || c0 > c1 || + r1 >= mat1->numrows_ || c1 >= mat1->numcols_ || !mat1->rows_) { + return -1; + } + if (mat0->data_) { if (!(mat0->flags_ & JAS_MATRIX_REF)) { jas_free(mat0->data_);