[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

2024-11-13 Thread Kacper Michajłow
ffmpeg | branch: release/7.0 | Kacper Michajłow  | Fri Nov  
1 13:50:38 2024 +0100| [caaa4d2d6a2d84a11bb8a025e92c8bdb9788e593] | committer: 
Leo Izen

avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

Found by OSS-Fuzz.

Signed-off-by: Kacper Michajłow 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=caaa4d2d6a2d84a11bb8a025e92c8bdb9788e593
---

 libavcodec/jpegxl_parser.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 8c45e1a1b7..746c429b9c 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 // permuted toc
 if (get_bits1(gb)) {
 JXLEntropyDecoder dec;
-uint32_t end, lehmer = 0;
+int64_t end, lehmer = 0;
 ret = entropy_decoder_init(avctx, gb, &dec, 8);
 if (ret < 0)
 return ret;
@@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 return AVERROR_BUFFER_TOO_SMALL;
 }
 end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count));
-if (end > toc_count) {
+if (end < 0 || end > toc_count) {
 entropy_decoder_close(&dec);
 return AVERROR_INVALIDDATA;
 }
 for (uint32_t i = 0; i < end; i++) {
 lehmer = entropy_decoder_read_symbol(gb, &dec, 
toc_context(lehmer));
-if (get_bits_left(gb) < 0) {
+if (lehmer < 0 || get_bits_left(gb) < 0) {
 entropy_decoder_close(&dec);
 return AVERROR_BUFFER_TOO_SMALL;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

2024-11-13 Thread Kacper Michajłow
ffmpeg | branch: release/6.1 | Kacper Michajłow  | Fri Nov  
1 13:50:38 2024 +0100| [d0852a36cf920e09077239c37f4231038bee3ec8] | committer: 
Leo Izen

avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

Found by OSS-Fuzz.

Signed-off-by: Kacper Michajłow 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d0852a36cf920e09077239c37f4231038bee3ec8
---

 libavcodec/jpegxl_parser.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 300134be5d..f9b5f167f2 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 // permuted toc
 if (get_bits1(gb)) {
 JXLEntropyDecoder dec;
-uint32_t end, lehmer = 0;
+int64_t end, lehmer = 0;
 ret = entropy_decoder_init(avctx, gb, &dec, 8);
 if (ret < 0)
 return ret;
@@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 return AVERROR_BUFFER_TOO_SMALL;
 }
 end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count));
-if (end > toc_count) {
+if (end < 0 || end > toc_count) {
 entropy_decoder_close(&dec);
 return AVERROR_INVALIDDATA;
 }
 for (uint32_t i = 0; i < end; i++) {
 lehmer = entropy_decoder_read_symbol(gb, &dec, 
toc_context(lehmer));
-if (get_bits_left(gb) < 0) {
+if (lehmer < 0 || get_bits_left(gb) < 0) {
 entropy_decoder_close(&dec);
 return AVERROR_BUFFER_TOO_SMALL;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

2024-11-13 Thread Kacper Michajłow
ffmpeg | branch: release/7.1 | Kacper Michajłow  | Fri Nov  
1 13:50:38 2024 +0100| [03ffd4b3b36535833ba179823dc26e811650581d] | committer: 
Leo Izen

avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

Found by OSS-Fuzz.

Signed-off-by: Kacper Michajłow 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=03ffd4b3b36535833ba179823dc26e811650581d
---

 libavcodec/jpegxl_parser.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 8c45e1a1b7..746c429b9c 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 // permuted toc
 if (get_bits1(gb)) {
 JXLEntropyDecoder dec;
-uint32_t end, lehmer = 0;
+int64_t end, lehmer = 0;
 ret = entropy_decoder_init(avctx, gb, &dec, 8);
 if (ret < 0)
 return ret;
@@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 return AVERROR_BUFFER_TOO_SMALL;
 }
 end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count));
-if (end > toc_count) {
+if (end < 0 || end > toc_count) {
 entropy_decoder_close(&dec);
 return AVERROR_INVALIDDATA;
 }
 for (uint32_t i = 0; i < end; i++) {
 lehmer = entropy_decoder_read_symbol(gb, &dec, 
toc_context(lehmer));
-if (get_bits_left(gb) < 0) {
+if (lehmer < 0 || get_bits_left(gb) < 0) {
 entropy_decoder_close(&dec);
 return AVERROR_BUFFER_TOO_SMALL;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".


[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

2024-11-05 Thread Kacper Michajłow
ffmpeg | branch: master | Kacper Michajłow  | Fri Nov  1 
13:50:38 2024 +0100| [7b20985d8d886fb32badc94f8d210bb596b19c2d] | committer: 
Leo Izen

avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value

Found by OSS-Fuzz.

Signed-off-by: Kacper Michajłow 

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7b20985d8d886fb32badc94f8d210bb596b19c2d
---

 libavcodec/jpegxl_parser.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 8c45e1a1b7..746c429b9c 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 // permuted toc
 if (get_bits1(gb)) {
 JXLEntropyDecoder dec;
-uint32_t end, lehmer = 0;
+int64_t end, lehmer = 0;
 ret = entropy_decoder_init(avctx, gb, &dec, 8);
 if (ret < 0)
 return ret;
@@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, 
JXLParseContext *ctx, GetBitContext *
 return AVERROR_BUFFER_TOO_SMALL;
 }
 end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count));
-if (end > toc_count) {
+if (end < 0 || end > toc_count) {
 entropy_decoder_close(&dec);
 return AVERROR_INVALIDDATA;
 }
 for (uint32_t i = 0; i < end; i++) {
 lehmer = entropy_decoder_read_symbol(gb, &dec, 
toc_context(lehmer));
-if (get_bits_left(gb) < 0) {
+if (lehmer < 0 || get_bits_left(gb) < 0) {
 entropy_decoder_close(&dec);
 return AVERROR_BUFFER_TOO_SMALL;
 }

___
ffmpeg-cvslog mailing list
ffmpeg-cvslog@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog

To unsubscribe, visit link above, or email
ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".