From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 4AA3D4AF8D for ; Wed, 29 Jan 2025 19:58:29 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id B830068BD96; Wed, 29 Jan 2025 21:58:25 +0200 (EET) Received: from mail-qt1-f174.google.com (mail-qt1-f174.google.com [209.85.160.174]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 11F4968BB36 for ; Wed, 29 Jan 2025 21:58:19 +0200 (EET) Received: by mail-qt1-f174.google.com with SMTP id d75a77b69052e-467a63f5d1cso457371cf.0 for ; Wed, 29 Jan 2025 11:58:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1738180698; x=1738785498; darn=ffmpeg.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=3xmPSSEx3263l0n/cJZRneOWwxzjmoCQe7ippaIoR5Q=; b=k1INIh2B//3ywBxvHhIbyS+Ue6LqcNmIParc/NnpTLJg3RlsRlP2Nudz1htmob/giG hgWgdAkRdjNPmLRwvIhWAYNsxJITwLnlchhbOM3kqzCHzGXF0eegNeae9w66M+Mfkv3F iuWExrTA2NKTln5CA80BV11Ffvf6Cs/JN8VQX9XUDTSbOwdNPZA/sKdj094JJg7Y0I3T LAE0TKqJWDib4ICQowqynWWvZBBdp08Vd2G1CIK/Qlz49n5agBJAc7QkNYcY4C2rvvC/ Kw5603wup5lcxpRUuCmqy5FuoePB2uscba8W9PUaXgLOzWCdJFHrBcoI6iepR+1DesJA HnvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1738180698; x=1738785498; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=3xmPSSEx3263l0n/cJZRneOWwxzjmoCQe7ippaIoR5Q=; b=nwMvRpP2sATIxKqPP/J+OaWaHbg93269BDfa/OIEK1flPGM15o8UmSQxm/W45r81hV ybVEeiWqqRJvx0k8/4KQE0UvuaIvhEe/Q06ZGDSb039HJVOEBW9yAuMO6rHpMSEpyLC/ nzayBAEysQGgEoQuH6yLdzu/oGDOeB4wv4zfiKx63xi/v+ubXmIqTvYghyPa1s1UPVZk dbNWqd9bE+EoGxPaKRpEGNspvy9q4Q+0QrFyFxyykINbWXOPDiVjXl63PsVxN85oa7lH 5zrap5l4Sz1ZCdnzk3JUb6bP3upjTDHiCTNq0qtlG/p/LV9pem2wR1LT3nng7UyAWz/C JW2w== X-Gm-Message-State: AOJu0YzlEZWmJqime3ZB6rpCr1C0zLAfAvJnaxDPlfX1uAcUGBCHqHSG /bfz84Ykjjm0YoKE9R8P/CI1XZVZwCICqPENu49MBdZxZQiY22O/hgts4Tm7 X-Gm-Gg: ASbGncvPc3U9uy8UftKGf5OX+i8qMffzSMtYbQoWTDmpSz6t1AjwD8tnPM3vtXcXDL2 nx/1d4cgVPcsRnOl5nG3cDr53kD2DlkN7b11AXfzGrbZFMMMirXKBnYWHa41soQ6wb/eOCrpAJ9 w2n1L6Qw2NrWeGGQe5vwumfOFmJkf2zKHhXPelSnoznVCZpKSVuybK12U21MA50uskVBSYtRF35 N37Lgv1O5HjECl8glN3uP7T0vqbktbtkxM5vutAOekDqvyMtko+Bkyu3mrpPM6SpnLWnMdPjOPl His2UceUeVaeci+Leo/P4R1Cg8CWhOOzsxlC+pXfi10+LnQTAJ3hqokn0ZXwQdSbn94= X-Google-Smtp-Source: AGHT+IFT14Sm0bPDGFrCWAz8Teqbe5NLFcbLDuVYXsjflIIYPEbWg74Vbdo9C25B26h0pFzNHQCFQA== X-Received: by 2002:ac8:5a0a:0:b0:462:ea22:33bb with SMTP id d75a77b69052e-46fd0b6f39fmr67367451cf.38.1738180697650; Wed, 29 Jan 2025 11:58:17 -0800 (PST) Received: from gauss.local (104-184-204-59.lightspeed.livnmi.sbcglobal.net. [104.184.204.59]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-46e6686311asm65314621cf.15.2025.01.29.11.58.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jan 2025 11:58:17 -0800 (PST) From: Leo Izen To: ffmpeg-devel@ffmpeg.org Date: Wed, 29 Jan 2025 14:58:15 -0500 Message-ID: <20250129195815.100902-1-leo.izen@gmail.com> X-Mailer: git-send-email 2.48.1 MIME-Version: 1.0 Subject: [FFmpeg-devel] [PATCH] avcodec/jpegxl_parse{, r}: fix integer overflow for some malformed files X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Cc: Kacper Michajlow , Leo Izen Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: If there's a very large ISOBMFF box that needs to be skipped, it can cause an overflow for ctx->skip. There's already a safeguard to return quickly if ctx->skip > bufsize, so changing ctx->skip to int64_t will allow this to happen even if ctx->skip would overflow a signed int. Several other members are also changed to int64_t to avoid this problem in other possible scenarios. Signed-off-by: Leo Izen Reported-by: Kacper Michajlow Fixes: clusterfuzz-testcase-minimized-fuzzer_loadfile-6085331937460224 --- libavcodec/jpegxl_parse.c | 5 +++-- libavcodec/jpegxl_parser.c | 16 ++++++++-------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/libavcodec/jpegxl_parse.c b/libavcodec/jpegxl_parse.c index 7cfdd3e7d5..022eed322d 100644 --- a/libavcodec/jpegxl_parse.c +++ b/libavcodec/jpegxl_parse.c @@ -450,7 +450,8 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l uint8_t *buffer, int buflen, int *copied) { GetByteContext gb; - int pos = 0, last_box = 0; + int64_t pos = 0; + int last_box = 0; bytestream2_init(&gb, input_buffer, input_len); while (1) { @@ -516,5 +517,5 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l break; } - return pos; + return FFMIN(pos, INT_MAX); } diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index a888e9ae6e..68404229a5 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -155,12 +155,12 @@ typedef struct JXLParseContext { /* using ISOBMFF-based container */ int container; - int skip; + int64_t skip; int copied; - int collected_size; - int codestream_length; + int64_t collected_size; + int64_t codestream_length; int skipped_icc; - int next; + int64_t next; uint8_t cs_buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE]; } JXLParseContext; @@ -1396,7 +1396,7 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size) return 0; } -static int try_parse(AVCodecParserContext *s, AVCodecContext *avctx, JXLParseContext *ctx, +static int64_t try_parse(AVCodecParserContext *s, AVCodecContext *avctx, JXLParseContext *ctx, const uint8_t *buf, int buf_size) { int ret, cs_buflen, header_skip; @@ -1489,10 +1489,10 @@ static int jpegxl_parse(AVCodecParserContext *s, AVCodecContext *avctx, } if ((!ctx->container || !ctx->codestream_length) && !ctx->next) { - ret = try_parse(s, avctx, ctx, pbuf, pindex); - if (ret < 0) + int64_t ret64 = try_parse(s, avctx, ctx, pbuf, pindex); + if (ret64 < 0) goto flush; - ctx->next = ret; + ctx->next = ret64; if (ctx->container) ctx->skip += ctx->next; } -- 2.48.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".