The JPEG XL parser has an entropy decoder inside, which supports LZ77 length-distance pairs. If the first symbol from the entropy stream is an LZ77 pair, the bitstream is invalid, so we should abort immediately rather than attempt to read it anyway (which would read from the uninitialized starting window).
Unified · Split
| @@ -352,6 +352,8 @@ static int decode_hybrid_varlen_uint(GetBitContext *gb, JXLEntropyDecoder *dec, · 351 unmodified lines | ||
| 352 | 352 | |
| 353 | 353 | if (bundle->lz77_enabled && token >= bundle->lz77_min_symbol) { |
| 354 | 354 | const JXLSymbolDistribution *lz77dist = &bundle->dists[bundle->cluster_map[bundle->num_dist - 1]]; |
| 355 | + if (!dec->num_decoded) | |
| 356 | + return AVERROR_INVALIDDATA; | |
| 355 | 357 | ret = read_hybrid_uint(gb, &bundle->lz_len_conf, token - bundle->lz77_min_symbol, &dec->num_to_copy); |
| 356 | 358 | if (ret < 0) |
| 357 | 359 | return ret; |
| @@ -531,6 +533,7 @@ static int read_dist_clustering(GetBitContext *gb, JXLEntropyDecoder *dec, JXLDi · 173 unmodified lines | ||
| 531 | 533 | dec->state = -1; |
| 532 | 534 | /* it's not going to necessarily be zero after reading */ |
| 533 | 535 | dec->num_to_copy = 0; |
| 536 | + dec->num_decoded = 0; | |
| 534 | 537 | dist_bundle_close(&nested); |
| 535 | 538 | if (use_mtf) { |
| 536 | 539 | uint8_t mtf[256]; |