| Message ID | 20231004225921.30287-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 88453250dbe952e85899d04867914ef95785530e |
| Headers | show |
| Series | [FFmpeg-devel,1/4] avcodec/jpeg2000dec: Check image offset | expand |
| Context | Check | Description |
|---|---|---|
| yinshiyou/make_loongarch64 | success | Make finished |
| yinshiyou/make_fate_loongarch64 | success | Make fate finished |
On Thu, 2023-10-05 at 00:59 +0200, Michael Niedermayer wrote: > Fixes: left shift of negative value -538967841 > Fixes: 62447/clusterfuzz-testcase-minimized- > ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6427134337613824 > > Found-by: continuous fuzzing process > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavcodec/jpeg2000dec.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c > index eda959e558d..691cfbd8915 100644 > --- a/libavcodec/jpeg2000dec.c > +++ b/libavcodec/jpeg2000dec.c > @@ -238,6 +238,11 @@ static int get_siz(Jpeg2000DecoderContext *s) > return AVERROR_INVALIDDATA; > } > > + if (s->image_offset_x >= s->width || s->image_offset_y >= s- > >height) { > + av_log(s->avctx, AV_LOG_ERROR, "image offsets outside > image"); > + return AVERROR_INVALIDDATA; > + } Probably OK /Tomas
On Wed, Oct 25, 2023 at 09:20:09PM +0200, Tomas Härdin wrote: > On Thu, 2023-10-05 at 00:59 +0200, Michael Niedermayer wrote: > > Fixes: left shift of negative value -538967841 > > Fixes: 62447/clusterfuzz-testcase-minimized- > > ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6427134337613824 > > > > Found-by: continuous fuzzing process > > https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > > --- > > libavcodec/jpeg2000dec.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c > > index eda959e558d..691cfbd8915 100644 > > --- a/libavcodec/jpeg2000dec.c > > +++ b/libavcodec/jpeg2000dec.c > > @@ -238,6 +238,11 @@ static int get_siz(Jpeg2000DecoderContext *s) > > return AVERROR_INVALIDDATA; > > } > > > > + if (s->image_offset_x >= s->width || s->image_offset_y >= s- > > >height) { > > + av_log(s->avctx, AV_LOG_ERROR, "image offsets outside > > image"); > > + return AVERROR_INVALIDDATA; > > + } > > Probably OK will apply thx [...]
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index eda959e558d..691cfbd8915 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -238,6 +238,11 @@ static int get_siz(Jpeg2000DecoderContext *s) return AVERROR_INVALIDDATA; } + if (s->image_offset_x >= s->width || s->image_offset_y >= s->height) { + av_log(s->avctx, AV_LOG_ERROR, "image offsets outside image"); + return AVERROR_INVALIDDATA; + } + if (s->reduction_factor && (s->image_offset_x || s->image_offset_y) ){ av_log(s->avctx, AV_LOG_ERROR, "reduction factor with image offsets is not fully implemented"); return AVERROR_PATCHWELCOME;
Fixes: left shift of negative value -538967841 Fixes: 62447/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-6427134337613824 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavcodec/jpeg2000dec.c | 5 +++++ 1 file changed, 5 insertions(+)