Fixes a bug where illegally long QCD,QCC can cause data corruption.

Author: aous72

src/core/codestream/ojph_params.cpp

@@ -1625,8 +1625,8 @@ namespace ojph {
       if ((Sqcd & 0x1F) == 0)
       {
         num_subbands = (Lqcd - 3);
-        if (Lqcd != 3 + num_subbands)
-          OJPH_ERROR(0x00050083, "wrong Lqcd value in QCD marker");
+        if (num_subbands > 97 || Lqcd != 3 + num_subbands)
+          OJPH_ERROR(0x00050083, "wrong Lqcd value of %d in QCD marker", Lqcd);
         for (ui32 i = 0; i < num_subbands; ++i)
           if (file->read(&SPqcd.u8[i], 1) != 1)
             OJPH_ERROR(0x00050084, "error reading QCD marker");
@@ -1642,8 +1642,8 @@ namespace ojph {
       else if ((Sqcd & 0x1F) == 2)
       {
         num_subbands = (Lqcd - 3) / 2;
-        if (Lqcd != 3 + 2 * num_subbands)
-          OJPH_ERROR(0x00050086, "wrong Lqcd value in QCD marker");
+        if (num_subbands > 97 || Lqcd != 3 + 2 * num_subbands)
+          OJPH_ERROR(0x00050086, "wrong Lqcd value of %d in QCD marker", Lqcd);
         for (ui32 i = 0; i < num_subbands; ++i)
         {
           if (file->read(&SPqcd.u16[i], 2) != 2)
@@ -1680,8 +1680,8 @@ namespace ojph {
       if ((Sqcd & 0x1F) == 0)
       {
         num_subbands = (Lqcd - offset);
-        if (Lqcd != offset + num_subbands)
-          OJPH_ERROR(0x000500A5, "wrong Lqcd value in QCC marker");
+        if (num_subbands > 97 || Lqcd != offset + num_subbands)
+          OJPH_ERROR(0x000500A5, "wrong Lqcd value of %d in QCC marker", Lqcd);
         for (ui32 i = 0; i < num_subbands; ++i)
           if (file->read(&SPqcd.u8[i], 1) != 1)
             OJPH_ERROR(0x000500A6, "error reading QCC marker");
@@ -1697,8 +1697,8 @@ namespace ojph {
       else if ((Sqcd & 0x1F) == 2)
       {
         num_subbands = (Lqcd - offset) / 2;
-        if (Lqcd != offset + 2 * num_subbands)
-          OJPH_ERROR(0x000500A8, "wrong Lqcc value in QCC marker");
+        if (num_subbands > 97 || Lqcd != offset + 2 * num_subbands)
+          OJPH_ERROR(0x000500A8, "wrong Lqcc value of %d in QCC marker", Lqcd);
         for (ui32 i = 0; i < num_subbands; ++i)
         {
           if (file->read(&SPqcd.u16[i], 2) != 2)

src/core/common/ojph_version.h

@@ -35,4 +35,4 @@
 
 #define OPENJPH_VERSION_MAJOR 0
 #define OPENJPH_VERSION_MINOR 24
-#define OPENJPH_VERSION_PATCH 2
+#define OPENJPH_VERSION_PATCH 3