Security context

Highlights

Integer Overflow: 37 prior fixes. Scrutinize any change in this area.

src/lib/openjp2/j2k.c: most-fixed (17 issues). Treat as high-risk during review.

62 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Integer Overflow: The most prolific vulnerability class. Overflows in size calculations for buffer allocations (opj_calloc/malloc/realloc) and in tile/precinct/component coordinate arithmetic repeatedly lead to undersized buffers or incorrect indexing, enabling subsequent heap corruption or OOB access. Must be fixed at the arithmetic level with 64-bit intermediates and explicit overflow checks.

Heap Buffer Overflow: Direct consequence of integer overflows and missing bounds checks during decode (component resolution mismatches, stream read errors, corrupt code blocks) and encode (marker writing without buffer size checks, MQ coder buffer under-allocation). Requires multi-layered validation: size overflow checks, dimension consistency checks, and output buffer capacity checks.

Buffer Overflow (including Stack): Conversion utilities suffer from unsafe C parsing: unbounded fscanf/sprintf, missing bounds on filename/dimension/code block parameters, and missing checks on component counts or dimensions before array access. These are client-side attack surfaces (malicious images) and must be hardened with width-limited functions and strict validation.