PR #21763 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21763 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21763.patch
Fixes: runtime error: shift exponent -1 is negative Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int' Fixes: 471846062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5835290976780288 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> >From b058c6d96d649e6f07f6fead8ff534c87e7c51c1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 15 Feb 2026 00:50:14 +0100 Subject: [PATCH] avcodec/jpeg2000dec: Handle M_b = -1 Fixes: runtime error: shift exponent -1 is negative Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int' Fixes: 471846062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5835290976780288 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/jpeg2000dec.c | 8 ++++---- libavcodec/jpeg2000htdec.c | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 017be6f025..40c6929eae 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -2100,7 +2100,7 @@ static int decode_cblk(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *cod for (int y = 0; y < height; y++) { for (int x = 0; x < width; x++) { int32_t sign, n, val; - const uint32_t mask = (UINT32_MAX >> M_b) >> 1; // bit mask for ROI detection + const uint32_t mask = (int64_t)UINT32_MAX >> (M_b + 1); // bit mask for ROI detection n = x + (y * t1->stride); val = t1->data[n]; @@ -2130,7 +2130,7 @@ static void dequantization_float(int x, int y, Jpeg2000Cblk *cblk, int w = cblk->coord[0][1] - cblk->coord[0][0]; const int downshift = 31 - M_b; float fscale = band->f_stepsize; - fscale /= (float)(1 << downshift); + fscale /= (float)(1LL << downshift); for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) { float *datap = &comp->f_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x]; int *src = t1->data + j*t1->stride; @@ -2149,7 +2149,7 @@ static void dequantization_int(int x, int y, Jpeg2000Cblk *cblk, Jpeg2000T1Context *t1, Jpeg2000Band *band, const int M_b) { int i, j; - const int downshift = 31 - M_b; + const int downshift = FFMIN(31 - M_b, 31); int w = cblk->coord[0][1] - cblk->coord[0][0]; for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) { int32_t *datap = &comp->i_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x]; @@ -2188,7 +2188,7 @@ static void dequantization_int_97(int x, int y, Jpeg2000Cblk *cblk, const int PRESCALE = 6; // At least 6 is required to pass the conformance tests in ISO/IEC 15444-4 int scale; - fscale /= (float)(1 << downshift); + fscale /= (float)(1LL << downshift); fscale *= (float)(1 << PRESCALE); fscale *= (float)(1 << (16 + I_PRESHIFT)); scale = (int)(fscale + 0.5); diff --git a/libavcodec/jpeg2000htdec.c b/libavcodec/jpeg2000htdec.c index b92f0131a4..785306cf2f 100644 --- a/libavcodec/jpeg2000htdec.c +++ b/libavcodec/jpeg2000htdec.c @@ -1219,7 +1219,7 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c uint8_t *block_states = NULL; int32_t n, val; // Post-processing - const uint32_t mask = (UINT32_MAX >> M_b) >> 1; // bit mask for ROI detection + const uint32_t mask = (int64_t)UINT32_MAX >> (M_b + 1); // bit mask for ROI detection uint8_t num_rempass; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
