From 2c3901b2c34b5e1f556d0e19c4cc218fdcbec695 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Mon, 1 Jul 2013 10:01:13 +0200
Subject: [PATCH 1/2] jpeg2000: Remove unneeded returns

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
---
 libavcodec/jpeg2000.c    | 2 --
 libavcodec/jpeg2000dec.c | 6 +-----
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/libavcodec/jpeg2000.c b/libavcodec/jpeg2000.c
index 5889f80576..51823e6cd7 100644
--- a/libavcodec/jpeg2000.c
+++ b/libavcodec/jpeg2000.c
@@ -115,7 +115,6 @@ static int getsigctxno(int flag, int bandno)
             return 2;
         if (d == 1)
             return 1;
-        return 0;
     } else {
         if (d >= 3)
             return 8;
@@ -135,7 +134,6 @@ static int getsigctxno(int flag, int bandno)
             return 2;
         if (h + v == 1)
             return 1;
-        return 0;
     }
     return 0;
 }
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 86ccad0881..1b40912152 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -992,7 +992,6 @@ static void dequantization_float(int x, int y, Jpeg2000Cblk *cblk,
             idx        = (comp->coord[0][1] - comp->coord[0][0]) * j + i;
             datap[idx] = (float)(t1->data[j][i]) * ((float)band->stepsize);
         }
-    return;
 }
 
 /* Integer dequantization of a codeblock.*/
@@ -1009,7 +1008,6 @@ static void dequantization_int(int x, int y, Jpeg2000Cblk *cblk,
             datap[idx] =
                 ((int32_t)(t1->data[j][i]) * ((int32_t)band->stepsize) + (1 << 15)) >> 16;
         }
-    return;
 }
 
 /* Inverse ICT parameters in float and integer.
@@ -1027,10 +1025,9 @@ static const int   i_ict_params[4] = {
     116130
 };
 
-static int mct_decode(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)
+static void mct_decode(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)
 {
     int i, csize = 1;
-    int ret = 0;
     int32_t *src[3],  i0,  i1,  i2;
     float   *srcf[3], i0f, i1f, i2f;
 
@@ -1076,7 +1073,6 @@ static int mct_decode(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile)
         }
         break;
     }
-    return ret;
 }
 
 static int jpeg2000_decode_tile(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile,

From b564784a207b1395d2b5a41e580539df04651096 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Mon, 1 Jul 2013 10:01:14 +0200
Subject: [PATCH 2/2] jpeg2000: Check that there is a SOT before SOD

Avoid overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
---
 libavcodec/jpeg2000dec.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 1b40912152..d0608f97f4 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -1236,6 +1236,22 @@ static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s)
         marker = bytestream2_get_be16u(&s->g);
         oldpos = bytestream2_tell(&s->g);
 
+        if (marker == JPEG2000_SOD) {
+            Jpeg2000Tile *tile;
+            Jpeg2000TilePart *tp;
+
+            if (s->curtileno < 0) {
+                av_log(s->avctx, AV_LOG_ERROR, "Missing SOT\n");
+                return AVERROR_INVALIDDATA;
+            }
+
+            tile = s->tile + s->curtileno;
+            tp = tile->tile_part + tile->tp_idx;
+            bytestream2_init(&tp->tpg, s->g.buffer, tp->tp_end - s->g.buffer);
+            bytestream2_skip(&s->g, tp->tp_end - s->g.buffer);
+
+            continue;
+        }
         if (marker == JPEG2000_EOC)
             break;