diff options
| author | Leo Izen <leo.izen@gmail.com> | 2023-11-27 09:10:06 -0500 |
|---|---|---|
| committer | Leo Izen <leo.izen@gmail.com> | 2023-12-05 05:53:32 -0500 |
| commit | 019b3ea65aee78cb68ee94beb37dab1bba5d2aa6 (patch) | |
| tree | 278786ddd18d17050a728c432d84c5bef456e29f /libavcodec | |
| parent | 35a555e2b98ecf79d217c421b912549b90d223b0 (diff) | |
| download | ffmpeg-019b3ea65aee78cb68ee94beb37dab1bba5d2aa6.tar.gz | |
avcodec/jpegxl_parse{,r}: use correct ISOBMFF extended size location
According to ISO/IEC 14996-12, size == 1 means a 64-bit extended-size
field occurs *after* the 32-bit box type, not before. This fix should
allow correct parsing of JXL files with extended-size boxes.
Signed-off-by: Leo Izen <leo.izen@gmail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/jpegxl_parse.c | 6 | ||||
| -rw-r--r-- | libavcodec/jpegxl_parser.c | 9 |
2 files changed, 8 insertions, 7 deletions
diff --git a/libavcodec/jpegxl_parse.c b/libavcodec/jpegxl_parse.c index eb28e80867..7cfdd3e7d5 100644 --- a/libavcodec/jpegxl_parse.c +++ b/libavcodec/jpegxl_parse.c @@ -462,8 +462,10 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l return AVERROR_BUFFER_TOO_SMALL; size = bytestream2_get_be32(&gb); + tag = bytestream2_get_le32(&gb); + if (size == 1) { - if (bytestream2_get_bytes_left(&gb) < 12) + if (bytestream2_get_bytes_left(&gb) < 8) return AVERROR_BUFFER_TOO_SMALL; size = bytestream2_get_be64(&gb); head_size = 16; @@ -474,8 +476,6 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l if (size) size -= head_size; - tag = bytestream2_get_le32(&gb); - if (tag == MKTAG('j','x','l','p')) { uint32_t idx; if (bytestream2_get_bytes_left(&gb) < 4) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 630fc8a60b..750872f17f 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1342,7 +1342,7 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size) while (1) { uint64_t size; - int head_size = 4; + int head_size = 8; if (bytestream2_peek_le16(&gb) == FF_JPEGXL_CODESTREAM_SIGNATURE_LE) break; @@ -1353,16 +1353,17 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size) return AVERROR_BUFFER_TOO_SMALL; size = bytestream2_get_be32(&gb); + bytestream2_skip(&gb, 4); // tag if (size == 1) { - if (bytestream2_get_bytes_left(&gb) < 12) + if (bytestream2_get_bytes_left(&gb) < 8) return AVERROR_BUFFER_TOO_SMALL; size = bytestream2_get_be64(&gb); - head_size = 12; + head_size = 16; } if (!size) return AVERROR_INVALIDDATA; /* invalid ISOBMFF size */ - if (size <= head_size + 4 || size > INT_MAX - ctx->skip) + if (size <= head_size || size > INT_MAX - ctx->skip) return AVERROR_INVALIDDATA; ctx->skip += size; |