Found by OSS-Fuzz.
Unified · Split
| @@ -1311,7 +1311,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * · 1310 unmodified lines | |||
| 1311 | // permuted toc | 1311 | // permuted toc |
| 1312 | if (get_bits1(gb)) { | 1312 | if (get_bits1(gb)) { |
| 1313 | JXLEntropyDecoder dec; | 1313 | JXLEntropyDecoder dec; |
| 1314 | uint32_t end, lehmer = 0; | 1314 | int64_t end, lehmer = 0; |
| 1315 | ret = entropy_decoder_init(avctx, gb, &dec, 8); | 1315 | ret = entropy_decoder_init(avctx, gb, &dec, 8); |
| 1316 | if (ret < 0) | 1316 | if (ret < 0) |
| 1317 | return ret; | 1317 | return ret; |
| @@ -1320,13 +1320,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * · 2 unmodified lines | |||
| 1320 | return AVERROR_BUFFER_TOO_SMALL; | 1320 | return AVERROR_BUFFER_TOO_SMALL; |
| 1321 | } | 1321 | } |
| 1322 | end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); | 1322 | end = entropy_decoder_read_symbol(gb, &dec, toc_context(toc_count)); |
| 1323 | if (end > toc_count) { | 1323 | if (end < 0 || end > toc_count) { |
| 1324 | entropy_decoder_close(&dec); | 1324 | entropy_decoder_close(&dec); |
| 1325 | return AVERROR_INVALIDDATA; | 1325 | return AVERROR_INVALIDDATA; |
| 1326 | } | 1326 | } |
| 1327 | for (uint32_t i = 0; i < end; i++) { | 1327 | for (uint32_t i = 0; i < end; i++) { |
| 1328 | lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); | 1328 | lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); |
| 1329 | if (get_bits_left(gb) < 0) { | 1329 | if (lehmer < 0 || get_bits_left(gb) < 0) { |
| 1330 | entropy_decoder_close(&dec); | 1330 | entropy_decoder_close(&dec); |
| 1331 | return AVERROR_BUFFER_TOO_SMALL; | 1331 | return AVERROR_BUFFER_TOO_SMALL; |
| 1332 | } | 1332 | } |