diff options
| author | Kacper Michajłow <kasper93@gmail.com> | 2024-11-01 13:50:38 +0100 |
|---|---|---|
| committer | Leo Izen <leo.izen@gmail.com> | 2024-11-05 08:44:43 -0500 |
| commit | 7b20985d8d886fb32badc94f8d210bb596b19c2d (patch) | |
| tree | b6541085c872dad12af1fdc6536bf9cc51b9b795 | |
| parent | c845a07302a20ff0c55d7f9634539df80404bfb3 (diff) | |
| download | ffmpeg-7b20985d8d886fb32badc94f8d210bb596b19c2d.tar.gz | |
avcodec/jpegxl_parser: check entropy_decoder_read_symbol return value
Found by OSS-Fuzz.
Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
| -rw-r--r-- | libavcodec/jpegxl_parser.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 8c45e1a1b7..746c429b9c 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * // permuted toc if (get_bits1(gb)) { JXLEntropyDecoder dec; - uint32_t end, lehmer = 0; + int64_t end, lehmer = 0; ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * return AVERROR_BUFFER_TOO_SMALL; } end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); - if (end > toc_count) { + if (end < 0 || end > toc_count) { entropy_decoder_close(&dec); return AVERROR_INVALIDDATA; } for (uint32_t i = 0; i < end; i++) { lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); - if (get_bits_left(gb) < 0) { + if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); return AVERROR_BUFFER_TOO_SMALL; } |