dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-13 17:07:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/jpeg2000htdec: Check Lcup and Lref

Browse Source 
Fixes: use of uninitialized memory
Fixes: 482494999/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-6467586186608640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 99515a3342)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-02-07 22:55:11 +01:00
parent 231b482bef
commit a3b60e266e
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/jpeg2000htdec.c
View File

@@ -1226,6 +1226,11 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c
"Cleanup pass length must be at least 2 bytes in length\n");
return AVERROR_INVALIDDATA;
}
// this might arise either if the codestream is corrupted; or contains multiple HT Sets
// (see Rec. ITU-T T.814, Annex B.1), which the parser does not currently support
if (Lcup + Lref != cblk->length)
return AVERROR_INVALIDDATA;
Dcup = cblk->data;
Dref = cblk->data + Lcup; // Dref comes after the refinement segment
S_blk = p0 + cblk->zbp;