diff mbox series

[FFmpeg-devel,1/3] avcodec/jpeg2000_parser: Check state!=0

Message ID 20210913224848.15336-1-michael@niedermayer.cc
State Accepted
Commit 7dfa8040d66a6e21898436fdf3568f67fd2f4eb8
Headers show
Series [FFmpeg-devel,1/3] avcodec/jpeg2000_parser: Check state!=0 | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished
andriy/make_ppc success Make finished
andriy/make_fate_ppc success Make fate finished

Commit Message

Michael Niedermayer Sept. 13, 2021, 10:48 p.m. UTC 
Fixes: out of array read
Fixes: 37664/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5893420460146688

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/jpeg2000_parser.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Paul B Mahol Sept. 14, 2021, 5:35 a.m. UTC | #1 
lgtm
Michael Niedermayer Sept. 14, 2021, 3:28 p.m. UTC | #2 
On Tue, Sep 14, 2021 at 07:35:50AM +0200, Paul B Mahol wrote:
> lgtm

will apply

thx

[...]
diff mbox series

Patch

diff --git a/libavcodec/jpeg2000_parser.c b/libavcodec/jpeg2000_parser.c
index e6db7eefa86..2975e71482a 100644
--- a/libavcodec/jpeg2000_parser.c
+++ b/libavcodec/jpeg2000_parser.c
@@ -142,7 +142,7 @@  static int find_frame_end(JPEG2000ParserContext *m, const uint8_t *buf, int buf_
             m->in_codestream = 0;
         } else if (m->in_codestream && (state & 0xFFFF) == 0xFF90) { // Are we in tile part header?
             m->read_tp = 8;
-        } else if (pc->frame_start_found && info_marker((state & 0xFFFF0000)>>16) && m->in_codestream) {
+        } else if (pc->frame_start_found && info_marker((state & 0xFFFF0000)>>16) && m->in_codestream && (state & 0xFFFF)) {
             // Calculate number of bytes to skip to get to end of the next marker.
             m->skip_bytes = (state & 0xFFFF)-1;