[FFmpeg-devel] [PATCH 4/5] avcodec/jpeg2000dec: Check that we arent reading with a non existing tile part

[Michael Niedermayer <michael@niedermayer.cc>]

Fixes: applying zero offset to null pointer
Fixes: 429330004/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_DEC_fuzzer-4733213845291008

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/jpeg2000dec.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index b82d85d5ee5..0e867025a38 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -1156,6 +1156,10 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile,
     else
         select_stream(s, tile, tp_index, codsty);
 
+    // refering to a non existing tile part
+    if (!s->g.buffer)
+        return AVERROR_INVALIDDATA;
+
     if (!(ret = get_bits(s, 1))) {
         jpeg2000_flush(s);
         goto skip_data;
@@ -1868,7 +1872,8 @@ static int jpeg2000_decode_packets(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile
         );
     }
     /* EOC marker reached */
-    bytestream2_skip(&s->g, 2);
+    if (ret >= 0)
+        bytestream2_skip(&s->g, 2);
 
     return ret;
 }
-- 
2.49.0

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".