Fixes: out of array access Fixes: poc.jp2
Unified · Split
| @@ -282,6 +282,14 @@ static int get_siz(Jpeg2000DecoderContext *s) · 281 unmodified lines | |||
| 282 | } | 282 | } |
| 283 | // after here we no longer have to consider negative cdef | 283 | // after here we no longer have to consider negative cdef |
| 284 | 284 | ||
| 285 | int cdef_used = 0; | ||
| 286 | for (i = 0; i < s->ncomponents; i++) | ||
| 287 | cdef_used |= 1<<s->cdef[i]; | ||
| 288 | |||
| 289 | // Check that the channels we have are what we expect for the number of components | ||
| 290 | if (cdef_used != ((int[]){0,2,3,14,15})[s->ncomponents]) | ||
| 291 | return AVERROR_INVALIDDATA; | ||
| 292 | |||
| 285 | for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i | 293 | for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i |
| 286 | uint8_t x = bytestream2_get_byteu(&s->g); | 294 | uint8_t x = bytestream2_get_byteu(&s->g); |
| 287 | s->cbps[i] = (x & 0x7f) + 1; | 295 | s->cbps[i] = (x & 0x7f) + 1; |
| @@ -294,7 +302,9 @@ static int get_siz(Jpeg2000DecoderContext *s) · 6 unmodified lines | |||
| 294 | av_log(s->avctx, AV_LOG_ERROR, "Invalid sample separation %d/%d\n", s->cdx[i], s->cdy[i]); | 302 | av_log(s->avctx, AV_LOG_ERROR, "Invalid sample separation %d/%d\n", s->cdx[i], s->cdy[i]); |
| 295 | return AVERROR_INVALIDDATA; | 303 | return AVERROR_INVALIDDATA; |
| 296 | } | 304 | } |
| 297 | log2_chroma_wh |= s->cdy[i] >> 1 << i * 4 | s->cdx[i] >> 1 << i * 4 + 2; | 305 | int i_remapped = s->cdef[i] ? s->cdef[i]-1 : (s->ncomponents-1); |
| 306 | |||
| 307 | log2_chroma_wh |= s->cdy[i] >> 1 << i_remapped * 4 | s->cdx[i] >> 1 << i_remapped * 4 + 2; | ||
| 298 | } | 308 | } |
| 299 | 309 | ||
| 300 | s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width); | 310 | s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width); |