diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-12-17 18:29:45 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-12-21 19:48:41 +0100 |
| commit | 42274db1c623d2c0acd616cc0d3a0e5489e3bdb2 (patch) | |
| tree | 1f6cfebde5da75dc9a70287f159cddbb6ad080ee /libavcodec | |
| parent | 1083859cb8c9d9b3bcee970dd33b71015a0a11bc (diff) | |
| download | ffmpeg-42274db1c623d2c0acd616cc0d3a0e5489e3bdb2.tar.gz | |
avcodec/jpeg2000dec: Allocate lengthinc and data_start arrays as needed
Decreases memory requirements
Fixes: OOM
Fixes: 4525/clusterfuzz-testcase-minimized-6400713073623040
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/jpeg2000.c | 3 | ||||
| -rw-r--r-- | libavcodec/jpeg2000.h | 4 | ||||
| -rw-r--r-- | libavcodec/jpeg2000dec.c | 9 |
3 files changed, 13 insertions, 3 deletions
diff --git a/libavcodec/jpeg2000.c b/libavcodec/jpeg2000.c index 5f3965047f..e7f03bd0df 100644 --- a/libavcodec/jpeg2000.c +++ b/libavcodec/jpeg2000.c @@ -359,7 +359,6 @@ static int init_prec(Jpeg2000Band *band, cblk->lblock = 3; cblk->length = 0; - memset(cblk->lengthinc, 0, sizeof(cblk->lengthinc)); cblk->npasses = 0; } @@ -607,6 +606,8 @@ void ff_jpeg2000_cleanup(Jpeg2000Component *comp, Jpeg2000CodingStyle *codsty) Jpeg2000Cblk *cblk = &prec->cblk[cblkno]; av_freep(&cblk->data); av_freep(&cblk->passes); + av_freep(&cblk->lengthinc); + av_freep(&cblk->data_start); } av_freep(&prec->cblk); } diff --git a/libavcodec/jpeg2000.h b/libavcodec/jpeg2000.h index 752feae96b..c429ca5996 100644 --- a/libavcodec/jpeg2000.h +++ b/libavcodec/jpeg2000.h @@ -165,14 +165,14 @@ typedef struct Jpeg2000Cblk { uint8_t ninclpasses; // number coding of passes included in codestream uint8_t nonzerobits; uint16_t length; - uint16_t lengthinc[JPEG2000_MAX_PASSES]; + uint16_t *lengthinc; uint8_t nb_lengthinc; uint8_t lblock; uint8_t *data; size_t data_allocated; int nb_terminations; int nb_terminationsinc; - int data_start[JPEG2000_MAX_PASSES]; + int *data_start; Jpeg2000Pass *passes; int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}} } Jpeg2000Cblk; // code block diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 0309b1f6fb..617273b36b 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -949,6 +949,7 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile, for (cblkno = 0; cblkno < nb_code_blocks; cblkno++) { Jpeg2000Cblk *cblk = prec->cblk + cblkno; int incl, newpasses, llen; + void *tmp; if (cblk->npasses) incl = get_bits(s, 1); @@ -988,6 +989,14 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile, cblk->nb_lengthinc = 0; cblk->nb_terminationsinc = 0; + av_free(cblk->lengthinc); + cblk->lengthinc = av_mallocz_array(newpasses , sizeof(*cblk->lengthinc)); + if (!cblk->lengthinc) + return AVERROR(ENOMEM); + tmp = av_realloc_array(cblk->data_start, cblk->nb_terminations + newpasses + 1, sizeof(*cblk->data_start)); + if (!tmp) + return AVERROR(ENOMEM); + cblk->data_start = tmp; do { int newpasses1 = 0; |