diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index a16a2733f9..902a1532aa 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1393,12 +1393,15 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size) return AVERROR_BUFFER_TOO_SMALL; size = bytestream2_get_be64(&gb); head_size = 16; + } else if (!size) { + /* the box extends to the end of the file */ + return END_NOT_FOUND; } - if (!size) - return AVERROR_INVALIDDATA; /* invalid ISOBMFF size */ - if (size <= head_size || size > INT_MAX - ctx->skip) + if (size < head_size) return AVERROR_INVALIDDATA; + if (size > INT_MAX - ctx->skip) + return END_NOT_FOUND; ctx->skip += size; bytestream2_skip(&gb, size - head_size); @@ -1512,12 +1515,19 @@ static int jpegxl_parse(AVCodecParserContext *s, AVCodecContext *avctx, if (ctx->container && ctx->next >= 0) { ret = skip_boxes(ctx, pbuf, pindex); - if (ret < 0) { - if (ret == AVERROR_INVALIDDATA) - ctx->next = -1; + if (ret == END_NOT_FOUND) { + /* the rest of the stream belongs to this image */ + ctx->next = -1; goto flush; + } else if (ret == AVERROR_INVALIDDATA) { + /* end the image at the invalid box */ + av_log(avctx, AV_LOG_ERROR, "Invalid ISOBMFF box size\n"); + ctx->next = ctx->skip; + } else if (ret < 0) { + goto flush; + } else { + ctx->next = ret + ctx->skip; } - ctx->next = ret + ctx->skip; } if (ctx->next >= 0)