Fixes: out of array access Fixes: poc.jp2
Unified · Split
| @@ -282,6 +282,14 @@ static int get_siz(Jpeg2000DecoderContext *s) · 281 unmodified lines | ||
| 282 | 282 | } |
| 283 | 283 | // after here we no longer have to consider negative cdef |
| 284 | 284 | |
| 285 | + int cdef_used = 0; | |
| 286 | + for (i = 0; i < s->ncomponents; i++) | |
| 287 | + cdef_used |= 1<<s->cdef[i]; | |
| 288 | + | |
| 289 | + // Check that the channels we have are what we expect for the number of components | |
| 290 | + if (cdef_used != ((int[]){0,2,3,14,15})[s->ncomponents]) | |
| 291 | + return AVERROR_INVALIDDATA; | |
| 292 | + | |
| 285 | 293 | for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i |
| 286 | 294 | uint8_t x = bytestream2_get_byteu(&s->g); |
| 287 | 295 | s->cbps[i] = (x & 0x7f) + 1; |
| @@ -294,7 +302,9 @@ static int get_siz(Jpeg2000DecoderContext *s) · 6 unmodified lines | ||
| 294 | 302 | av_log(s->avctx, AV_LOG_ERROR, "Invalid sample separation %d/%d\n", s->cdx[i], s->cdy[i]); |
| 295 | 303 | return AVERROR_INVALIDDATA; |
| 296 | 304 | } |
| 297 | − log2_chroma_wh |= s->cdy[i] >> 1 << i * 4 | s->cdx[i] >> 1 << i * 4 + 2; | |
| 305 | + int i_remapped = s->cdef[i] ? s->cdef[i]-1 : (s->ncomponents-1); | |
| 306 | + | |
| 307 | + log2_chroma_wh |= s->cdy[i] >> 1 << i_remapped * 4 | s->cdx[i] >> 1 << i_remapped * 4 + 2; | |
| 298 | 308 | } |
| 299 | 309 | |
| 300 | 310 | s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width); |