[FFmpeg-devel] [PR] avcodec/jpeg2000dec: Handle M_b = -1 (PR #21763)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21763 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21763
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21763.patch

Fixes: runtime error: shift exponent -1 is negative
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 471846062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5835290976780288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From b058c6d96d649e6f07f6fead8ff534c87e7c51c1 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Sun, 15 Feb 2026 00:50:14 +0100
Subject: [PATCH] avcodec/jpeg2000dec: Handle M_b = -1

Fixes: runtime error: shift exponent -1 is negative
Fixes: runtime error: shift exponent 32 is too large for 32-bit type 'int'
Fixes: 471846062/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-5835290976780288

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/jpeg2000dec.c   | 8 ++++----
 libavcodec/jpeg2000htdec.c | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 017be6f025..40c6929eae 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -2100,7 +2100,7 @@ static int decode_cblk(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *cod
     for (int y = 0; y < height; y++) {
         for (int x = 0; x < width; x++) {
             int32_t sign, n, val;
-            const uint32_t mask  = (UINT32_MAX >> M_b) >> 1; // bit mask for ROI detection
+            const uint32_t mask  = (int64_t)UINT32_MAX >> (M_b + 1); // bit mask for ROI detection
 
             n = x + (y * t1->stride);
             val = t1->data[n];
@@ -2130,7 +2130,7 @@ static void dequantization_float(int x, int y, Jpeg2000Cblk *cblk,
     int w = cblk->coord[0][1] - cblk->coord[0][0];
     const int downshift = 31 - M_b;
     float fscale = band->f_stepsize;
-    fscale /= (float)(1 << downshift);
+    fscale /= (float)(1LL << downshift);
     for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) {
         float *datap = &comp->f_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x];
         int *src = t1->data + j*t1->stride;
@@ -2149,7 +2149,7 @@ static void dequantization_int(int x, int y, Jpeg2000Cblk *cblk,
                                Jpeg2000T1Context *t1, Jpeg2000Band *band, const int M_b)
 {
     int i, j;
-    const int downshift = 31 - M_b;
+    const int downshift = FFMIN(31 - M_b, 31);
     int w = cblk->coord[0][1] - cblk->coord[0][0];
     for (j = 0; j < (cblk->coord[1][1] - cblk->coord[1][0]); ++j) {
         int32_t *datap = &comp->i_data[(comp->coord[0][1] - comp->coord[0][0]) * (y + j) + x];
@@ -2188,7 +2188,7 @@ static void dequantization_int_97(int x, int y, Jpeg2000Cblk *cblk,
     const int PRESCALE = 6; // At least 6 is required to pass the conformance tests in ISO/IEC 15444-4
     int scale;
 
-    fscale /= (float)(1 << downshift);
+    fscale /= (float)(1LL << downshift);
     fscale *= (float)(1 << PRESCALE);
     fscale *= (float)(1 << (16 + I_PRESHIFT));
     scale = (int)(fscale + 0.5);
diff --git a/libavcodec/jpeg2000htdec.c b/libavcodec/jpeg2000htdec.c
index b92f0131a4..785306cf2f 100644
--- a/libavcodec/jpeg2000htdec.c
+++ b/libavcodec/jpeg2000htdec.c
@@ -1219,7 +1219,7 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c
     uint8_t *block_states = NULL;
 
     int32_t n, val;             // Post-processing
-    const uint32_t mask  = (UINT32_MAX >> M_b) >> 1; // bit mask for ROI detection
+    const uint32_t mask  = (int64_t)UINT32_MAX >> (M_b + 1); // bit mask for ROI detection
 
     uint8_t num_rempass;
 
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org