Re: [FFmpeg-devel] [PATCH 3/3] avcodec/jpeg2000htdec: Check m

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [PATCH 3/3] avcodec/jpeg2000htdec: Check m
Date: Sat, 5 Aug 2023 18:30:03 +0200
Message-ID: <20230805163003.GS7802@pb2> (raw)
In-Reply-To: <CAF_7JxA0Ccr3ZFW-28+Cau=M6MLeXzta-DW=SihSUui+X57DGw@mail.gmail.com>

[-- Attachment #1.1: Type: text/plain, Size: 1844 bytes --]

On Fri, Aug 04, 2023 at 06:19:46PM -0700, Pierre-Anthony Lemieux wrote:
> On Tue, Aug 1, 2023 at 5:02 PM Michael Niedermayer
> <michael@niedermayer.cc> wrote:
> >
> > This also fixes assertion failures
> >
> > Fixes: shift exponent 95 is too large for 64-bit type 'unsigned long long'
> > Fixes: 58299/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-5828618092937216
> >
> > Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
> > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> > ---
> >  libavcodec/jpeg2000htdec.c | 22 ++++++++++++++++++++--
> >  1 file changed, 20 insertions(+), 2 deletions(-)
> >
> > diff --git a/libavcodec/jpeg2000htdec.c b/libavcodec/jpeg2000htdec.c
> > index 3985783f3a..ae2ee6d6ee 100644
> > --- a/libavcodec/jpeg2000htdec.c
> > +++ b/libavcodec/jpeg2000htdec.c
> > @@ -689,6 +689,10 @@ static int jpeg2000_decode_ht_cleanup_segment(const Jpeg2000DecoderContext *s,
> >          for (int i = 0; i < 4; i++) {
> >              m[J2K_Q1][i] = sigma_n[4 * q1 + i] * U[J2K_Q1] - ((emb_pat_k[J2K_Q1] >> i) & 1);
> >              m[J2K_Q2][i] = sigma_n[4 * q2 + i] * U[J2K_Q2] - ((emb_pat_k[J2K_Q2] >> i) & 1);
> > +            if (m[J2K_Q1][i] > 63 || m[J2K_Q2][i] > 63) {
> 
> AFAIK, m[i], which is m_n in the standard, can never be larger than
> the sample bit depth (including the sign bit, if any). Is it worth
> comparing it to a value more precise than 63?

probably, yes
I think you know the spec better than i do, so you can probably pick
the tightest bound quicker ...
can you submit a patch doing that ?

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The greatest way to live with honor in this world is to be what we pretend
to be. -- Socrates

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".