[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value
ffmpeg | branch: release/7.0 | Kacper Michajłow | Fri Nov 1 13:50:38 2024 +0100| [caaa4d2d6a2d84a11bb8a025e92c8bdb9788e593] | committer: Leo Izen avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value Found by OSS-Fuzz. Signed-off-by: Kacper Michajłow > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=caaa4d2d6a2d84a11bb8a025e92c8bdb9788e593 --- libavcodec/jpegxl_parser.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 8c45e1a1b7..746c429b9c 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * // permuted toc if (get_bits1(gb)) { JXLEntropyDecoder dec; -uint32_t end, lehmer = 0; +int64_t end, lehmer = 0; ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * return AVERROR_BUFFER_TOO_SMALL; } end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); -if (end > toc_count) { +if (end < 0 || end > toc_count) { entropy_decoder_close(&dec); return AVERROR_INVALIDDATA; } for (uint32_t i = 0; i < end; i++) { lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); -if (get_bits_left(gb) < 0) { +if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); return AVERROR_BUFFER_TOO_SMALL; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value
ffmpeg | branch: release/6.1 | Kacper Michajłow | Fri Nov 1 13:50:38 2024 +0100| [d0852a36cf920e09077239c37f4231038bee3ec8] | committer: Leo Izen avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value Found by OSS-Fuzz. Signed-off-by: Kacper Michajłow > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d0852a36cf920e09077239c37f4231038bee3ec8 --- libavcodec/jpegxl_parser.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 300134be5d..f9b5f167f2 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * // permuted toc if (get_bits1(gb)) { JXLEntropyDecoder dec; -uint32_t end, lehmer = 0; +int64_t end, lehmer = 0; ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * return AVERROR_BUFFER_TOO_SMALL; } end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); -if (end > toc_count) { +if (end < 0 || end > toc_count) { entropy_decoder_close(&dec); return AVERROR_INVALIDDATA; } for (uint32_t i = 0; i < end; i++) { lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); -if (get_bits_left(gb) < 0) { +if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); return AVERROR_BUFFER_TOO_SMALL; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value
ffmpeg | branch: release/7.1 | Kacper Michajłow | Fri Nov 1 13:50:38 2024 +0100| [03ffd4b3b36535833ba179823dc26e811650581d] | committer: Leo Izen avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value Found by OSS-Fuzz. Signed-off-by: Kacper Michajłow > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=03ffd4b3b36535833ba179823dc26e811650581d --- libavcodec/jpegxl_parser.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 8c45e1a1b7..746c429b9c 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * // permuted toc if (get_bits1(gb)) { JXLEntropyDecoder dec; -uint32_t end, lehmer = 0; +int64_t end, lehmer = 0; ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * return AVERROR_BUFFER_TOO_SMALL; } end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); -if (end > toc_count) { +if (end < 0 || end > toc_count) { entropy_decoder_close(&dec); return AVERROR_INVALIDDATA; } for (uint32_t i = 0; i < end; i++) { lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); -if (get_bits_left(gb) < 0) { +if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); return AVERROR_BUFFER_TOO_SMALL; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
[FFmpeg-cvslog] avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value
ffmpeg | branch: master | Kacper Michajłow | Fri Nov 1 13:50:38 2024 +0100| [7b20985d8d886fb32badc94f8d210bb596b19c2d] | committer: Leo Izen avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value Found by OSS-Fuzz. Signed-off-by: Kacper Michajłow > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7b20985d8d886fb32badc94f8d210bb596b19c2d --- libavcodec/jpegxl_parser.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 8c45e1a1b7..746c429b9c 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * // permuted toc if (get_bits1(gb)) { JXLEntropyDecoder dec; -uint32_t end, lehmer = 0; +int64_t end, lehmer = 0; ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * return AVERROR_BUFFER_TOO_SMALL; } end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); -if (end > toc_count) { +if (end < 0 || end > toc_count) { entropy_decoder_close(&dec); return AVERROR_INVALIDDATA; } for (uint32_t i = 0; i < end; i++) { lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); -if (get_bits_left(gb) < 0) { +if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); return AVERROR_BUFFER_TOO_SMALL; } ___ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".