| Message ID | 20231013014959.536776-1-leo.izen@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [FFmpeg-devel] avcodec/jpegxl_parser: fix OOB read regression | expand |
| Context | Check | Description |
|---|---|---|
| andriy/make_x86 | success | Make finished |
| andriy/make_fate_x86 | success | Make fate finished |
diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index dde36b0d6e..e00e01e82b 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -726,8 +726,8 @@ static int read_vlc_prefix(GetBitContext *gb, JXLEntropyDecoder *dec, JXLSymbolD if (ret < 0) goto end; - buf = av_mallocz(dist->alphabet_size * (2 * sizeof(int8_t) + sizeof(int16_t) + sizeof(uint32_t)) - + sizeof(uint32_t)); + buf = av_mallocz(dist->alphabet_size * (2 * sizeof(int8_t) + sizeof(int16_t)) + + FFMAX(15, dist->alphabet_size + 1) * sizeof(uint32_t)); if (!buf) { ret = AVERROR(ENOMEM); goto end;
In f7ac3512f5b5cb8eb149f37300b43461d8e93af3 the size of the dynamically allocated buffer was shrunk, but it was made too small for very small alphabet sizes. This patch sets a minimum size to prevent an OOB read. Reported-by: Cole Dilorenzo <coolkingcole@gmail.com> Signed-off-by: Leo Izen <leo.izen@gmail.com> --- libavcodec/jpegxl_parser.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)