RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-27 09:11:17 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/jpeg2000dec: Fix/check for multiple integer overflows

Browse Source 
Fixes: shift exponent 35 is too large for 32-bit type 'int'
Fixes: 22857/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5202709358837760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-06-11 22:45:27 +02:00
parent 04ddace9e8
commit c579ceffbe
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libavcodec/jpeg2000dec.c
View File

@ -612,12 +612,19 @@ static int get_rgn(Jpeg2000DecoderContext *s, int n)
// Currently compno cannot be greater than 4. // Currently compno cannot be greater than 4.
// However, future implementation should support compno up to 65536 // However, future implementation should support compno up to 65536
if (compno < s->ncomponents) { if (compno < s->ncomponents) {
if (s->curtileno == -1) int v;
s->roi_shift[compno] = bytestream2_get_byte(&s->g); if (s->curtileno == -1) {
else { v = bytestream2_get_byte(&s->g);
if (v > 30)
return AVERROR_PATCHWELCOME;
s->roi_shift[compno] = v;
} else {
if (s->tile[s->curtileno].tp_idx != 0) if (s->tile[s->curtileno].tp_idx != 0)
return AVERROR_INVALIDDATA; // marker occurs only in first tile part of tile return AVERROR_INVALIDDATA; // marker occurs only in first tile part of tile
s->tile[s->curtileno].comp[compno].roi_shift = bytestream2_get_byte(&s->g); v = bytestream2_get_byte(&s->g);
if (v > 30)
return AVERROR_PATCHWELCOME;
s->tile[s->curtileno].comp[compno].roi_shift = v;
} }
return 0; return 0;
} }
@ -1669,8 +1676,8 @@ static int decode_cblk(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *codsty,
ff_mqc_initdec(&t1->mqc, cblk->data, 0, 1); ff_mqc_initdec(&t1->mqc, cblk->data, 0, 1);
while (passno--) { while (passno--) {
if (bpno < 0) { if (bpno < 0 || bpno > 29) {
av_log(s->avctx, AV_LOG_ERROR, "bpno became negative\n"); av_log(s->avctx, AV_LOG_ERROR, "bpno became invalid\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
switch(pass_t) { switch(pass_t) {