Found by OSS-Fuzz.
Unified · Split
| @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * · 1310 unmodified lines | ||
| 1311 | 1311 | // permuted toc |
| 1312 | 1312 | if (get_bits1(gb)) { |
| 1313 | 1313 | JXLEntropyDecoder dec; |
| 1314 | − uint32_t end, lehmer = 0; | |
| 1314 | + int64_t end, lehmer = 0; | |
| 1315 | 1315 | ret = entropy_decoder_init(avctx, gb, &dec, 8); |
| 1316 | 1316 | if (ret < 0) |
| 1317 | 1317 | return ret; |
| @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * · 2 unmodified lines | ||
| 1320 | 1320 | return AVERROR_BUFFER_TOO_SMALL; |
| 1321 | 1321 | } |
| 1322 | 1322 | end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); |
| 1323 | − if (end > toc_count) { | |
| 1323 | + if (end < 0 || end > toc_count) { | |
| 1324 | 1324 | entropy_decoder_close(&dec); |
| 1325 | 1325 | return AVERROR_INVALIDDATA; |
| 1326 | 1326 | } |
| 1327 | 1327 | for (uint32_t i = 0; i < end; i++) { |
| 1328 | 1328 | lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); |
| 1329 | − if (get_bits_left(gb) < 0) { | |
| 1329 | + if (lehmer < 0 || get_bits_left(gb) < 0) { | |
| 1330 | 1330 | entropy_decoder_close(&dec); |
| 1331 | 1331 | return AVERROR_BUFFER_TOO_SMALL; |
| 1332 | 1332 | } |