$hell on Earth

Here is a snippet of code showing the else condition:
else
{
}
/* “i” is the current position in the LP
array. It is adjusted based on the run
each time around. This implies that the
run value is the number of 0 elements in
the LP array between nonzero values. */
int k, i = 1;
for (k = 0; k < num_nonzero; k+=1)
{
i += RLCoeffs[k*2];
AdaptiveLPScan(image, LPInput[ndx], i, RLCoeffs[k*2+1]);
i += 1;
}
Here is how AdaptiveLPScan looks:
static void AdaptiveLPScan(jxr_image_t image, int lpinput_n[], int i, int
value)
{
assert(i > 0);
int k = image->lopass_scanorder[i-1];
lpinput_n[k] = value;
image->lopass_scantotals[i-1] += 1;
if (i>1 && image->lopass_scantotals[i-1] >
image->lopass_scantotals[i-2])
{
SWAP(image->lopass_scantotals[i-1], image->lopass_scantotals[i-2]);
SWAP(image->lopass_scanorder[i-1], image->lopass_scanorder[i-2]);
}
}
Once again, it is possible to write outside the bounds of the allocated buffer and write controlled values
to the stack.
40 | <strong>$hell</strong> on Earth: From Browser to System Compromise