Fixes: applying zero offset to null pointer Fixes: 429330004/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-4733213845291008
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/jpeg2000dec.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index b82d85d5ee5..0e867025a38 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -1156,6 +1156,10 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile, else select_stream(s, tile, tp_index, codsty); + // refering to a non existing tile part + if (!s->g.buffer) + return AVERROR_INVALIDDATA; + if (!(ret = get_bits(s, 1))) { jpeg2000_flush(s); goto skip_data; @@ -1868,7 +1872,8 @@ static int jpeg2000_decode_packets(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile ); } /* EOC marker reached */ - bytestream2_skip(&s->g, 2); + if (ret >= 0) + bytestream2_skip(&s->g, 2); return ret; } -- 2.49.0 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
