diff options
author | Leo Izen <leo.izen@gmail.com> | 2025-01-29 14:58:15 -0500 |
---|---|---|
committer | Leo Izen <leo.izen@gmail.com> | 2025-01-30 13:46:26 -0500 |
commit | 0225fe857d0d174e5c2b36642f5e02670f50b444 (patch) | |
tree | d601c0e14f30618c5519d3bc45122b352c91f590 /libavcodec/tests/rangecoder.c | |
parent | c5287178b4dc373e763f7cd49703a6e3192aab3a (diff) | |
download | ffmpeg-0225fe857d0d174e5c2b36642f5e02670f50b444.tar.gz |
avcodec/jpegxl_parse{,r}: fix integer overflow for some malformed files
If there's a very large ISOBMFF box that needs to be skipped, it can
cause an overflow for ctx->skip. There's already a safeguard to return
quickly if ctx->skip > bufsize, so changing ctx->skip to int64_t will
allow this to happen even if ctx->skip would overflow a signed int.
Several other members are also changed to int64_t to avoid this problem
in other possible scenarios.
Signed-off-by: Leo Izen <leo.izen@gmail.com>
Reported-by: Kacper Michajlow <kasper93@gmail.com>
Fixes: clusterfuzz-testcase-minimized-fuzzer_loadfile-6085331937460224
Diffstat (limited to 'libavcodec/tests/rangecoder.c')
0 files changed, 0 insertions, 0 deletions