On Thu, Aug 10, 2023 at 04:48:56PM -0700, pal@sandflow.com wrote:
> From: Pierre-Anthony Lemieux <pal@palemieux.com>
> 
> Intended to replace https://patchwork.ffmpeg.org/project/ffmpeg/patch/20230802000135.26482-3-michael@niedermayer.cc/
> with a more accurate block decoding magnitude bound.
> 
> ---
>  libavcodec/jpeg2000htdec.c | 32 +++++++++++++++++++++++++++++++-
>  1 file changed, 31 insertions(+), 1 deletion(-)
> 
> diff --git a/libavcodec/jpeg2000htdec.c b/libavcodec/jpeg2000htdec.c
> index 2c4cea5dd9..713dba17e3 100644
> --- a/libavcodec/jpeg2000htdec.c
> +++ b/libavcodec/jpeg2000htdec.c
> @@ -572,6 +572,14 @@ static int jpeg2000_decode_ht_cleanup_segment(const Jpeg2000DecoderContext *s,
>  
>      const uint8_t *vlc_buf = Dcup + Pcup;
>  
> +    /*
> +     * Bound on the recision needed to process the codeblock. The number of
> +     * decoded bit planes is equal to at most cblk->zbp + 2 since S_blk = P if
> +     * there are no placeholder passes or HT Sets and P = cblk->zbp. See Rec.
> +     * ITU-T T.814, 7.6.
> +     */
> +    int maxbp = cblk->zbp + 2;
> +
>      /* convert to raster-scan */
>      const uint16_t is_border_x = width % 2;
>      const uint16_t is_border_y = height % 2;
> @@ -590,6 +598,10 @@ static int jpeg2000_decode_ht_cleanup_segment(const Jpeg2000DecoderContext *s,
>          goto free;
>      }
>  
> +    /* do we have enough precision, assuming a 32-bit decoding path */
> +    if (maxbp >= 32)
> +        return AVERROR_INVALIDDATA;

doesnt this need a goto free ?

thx

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

No human being will ever know the Truth, for even if they happen to say it
by chance, they would not even known they had done so. -- Xenophanes