Skip to content

Commit 5e40bf5

Browse files
author
Grok Compression
committed
HTJ2K: widen code-block data padding to 16 bytes
The SIMD MagSgn forward reader does 16-byte vector loads that can read up to 16 bytes past the end of the code-block data, but the buffer was padded by only 8 bytes, so a small MagSgn segment (scup < 8) over-read the allocation. Pad by 16 bytes to cover the widest load. Advisory: GROK-0012 (CWE-125)
1 parent 58df402 commit 5e40bf5

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

src/lib/core/t1/part15/CoderOJPH.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,10 @@
2727
#include <cstdlib>
2828
#include <cstring>
2929

30-
const uint8_t grk_cblk_dec_compressed_data_pad_ht = 8;
30+
// 16 bytes: the SIMD HT MagSgn forward reader (frwd_read) issues 16-byte vector
31+
// loads that may run up to 16 bytes past the end of the code-block data, so the
32+
// trailing pad must be at least that wide.
33+
const uint8_t grk_cblk_dec_compressed_data_pad_ht = 16;
3134

3235
// Function pointer types for SIMD-dispatched block coding
3336
using decode_cb_t = bool (*)(grk::t1::ojph::ui8*, grk::t1::ojph::ui32*, grk::t1::ojph::ui32,

0 commit comments

Comments
 (0)