github-mirrors/FFmpeg
1
0
Fork 0
mirror of https://mirror.skon.top/https://github.com/FFmpeg/FFmpeg synced 2026-04-22 05:40:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/jpeg2000dec: Handle M_b = -1

Browse Source 
Fixes: runtime error: shift exponent -1 is negative
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 471846062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5835290976780288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-02-15 00:50:14 +01:00
parent 17cad7ac75
commit bdea5aec2d
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/jpeg2000dec.c
View File

@@ -2100,7 +2100,7 @@ static int decode_cblk(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *cod
for (int y = 0; y < height; y++) {
for (int x = 0; x < width; x++) {
int32_t sign, n, val;
const uint32_t mask = (UINT32_MAX >> M_b) >> 1; // bit mask for ROI detection
const uint32_t mask = (int64_t)UINT32_MAX >> (M_b + 1); // bit mask for ROI detection
n = x + (y * t1->stride);
val = t1->data[n];
@@ -2130,7 +2130,7 @@ static void dequantization_float(int x, int y, Jpeg2000Cblk *cblk,
int w = cblk->coord[0][1] - cblk->coord[0][0];
const int downshift = 31 - M_b;
float fscale = band->f_stepsize;
fscale /= (float)(1 << downshift);
fscale /= (float)(1LL << downshift);
for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) {
float *datap = &comp->f_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x];
int *src = t1->data + j*t1->stride;
@@ -2149,7 +2149,7 @@ static void dequantization_int(int x, int y, Jpeg2000Cblk *cblk,
Jpeg2000T1Context *t1, Jpeg2000Band *band, const int M_b)
{
int i, j;
const int downshift = 31 - M_b;
const int downshift = FFMIN(31 - M_b, 31);
int w = cblk->coord[0][1] - cblk->coord[0][0];
for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) {
int32_t *datap = &comp->i_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x];
@@ -2188,7 +2188,7 @@ static void dequantization_int_97(int x, int y, Jpeg2000Cblk *cblk,
const int PRESCALE = 6; // At least 6 is required to pass the conformance tests in ISO/IEC 15444-4
int scale;
fscale /= (float)(1 << downshift);
fscale /= (float)(1LL << downshift);
fscale *= (float)(1 << PRESCALE);
fscale *= (float)(1 << (16 + I_PRESHIFT));
scale = (int)(fscale + 0.5);

2
libavcodec/jpeg2000htdec.c
View File

@@ -1219,7 +1219,7 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c
uint8_t *block_states = NULL;
int32_t n, val; // Post-processing
const uint32_t mask = (UINT32_MAX >> M_b) >> 1; // bit mask for ROI detection
const uint32_t mask = (int64_t)UINT32_MAX >> (M_b + 1); // bit mask for ROI detection
uint8_t num_rempass;