xaymar/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/jpeg2000dec: implement cdef remapping during pixel format matching

Browse Source 
Fixes: out of array access
Fixes: poc.jp2

Fixes: CVE-2025-9951

Found-by: Andy Nguyen <theflow@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01a292c7e3)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit eb80096cbe)
Signed-off-by: Carlos Henrique Lima Melara <charlesmelara@riseup.net>
This commit is contained in:
Michael Niedermayer
2025-08-05 23:42:23 +02:00
committed by James Almer
parent 6dc71760d2
commit a7f6ee19a8
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/jpeg2000dec.c
+11 -1
View File
@@ -351,6 +351,14 @@ static int get_siz(Jpeg2000DecoderContext *s)
}
// after here we no longer have to consider negative cdef
int cdef_used = 0;
for (i = 0; i < s->ncomponents; i++)
cdef_used |= 1<<s->cdef[i];
// Check that the channels we have are what we expect for the number of components
if (cdef_used != ((int[]){0,2,3,14,15})[s->ncomponents])
return AVERROR_INVALIDDATA;
for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i
uint8_t x = bytestream2_get_byteu(&s->g);
s->cbps[i] = (x & 0x7f) + 1;
@@ -363,7 +371,9 @@ static int get_siz(Jpeg2000DecoderContext *s)
av_log(s->avctx, AV_LOG_ERROR, "Invalid sample separation %d/%d\n", s->cdx[i], s->cdy[i]);
return AVERROR_INVALIDDATA;
}
log2_chroma_wh |= s->cdy[i] >> 1 << i * 4 | s->cdx[i] >> 1 << i * 4 + 2;
int i_remapped = s->cdef[i] ? s->cdef[i]-1 : (s->ncomponents-1);
log2_chroma_wh |= s->cdy[i] >> 1 << i_remapped * 4 | s->cdx[i] >> 1 << i_remapped * 4 + 2;
}
s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width);