From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id CF3214C89F for ; Wed, 6 Aug 2025 09:13:44 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 79AC068C7E7; Wed, 6 Aug 2025 12:13:40 +0300 (EEST) Received: from 264e01bdf0e5 (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id B31CD68C7F8 for ; Wed, 6 Aug 2025 12:13:38 +0300 (EEST) MIME-Version: 1.0 From: michaelni To: ffmpeg-devel@ffmpeg.org Subject: [FFmpeg-devel] =?utf-8?q?=5BPATCH=5D_fix_j2k_cdef_out_of_array_?= =?utf-8?b?KFBSICMyMDEzMSk=?= X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Message-Id: <20250806091340.79AC068C7E7@ffbox0-bg.ffmpeg.org> Date: Wed, 6 Aug 2025 12:13:40 +0300 (EEST) Archived-At: List-Archive: List-Post: PR #20131 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20131 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20131.patch >From c7c16002ea3f9d6f284b61c7e5d4dc3fc9d1410a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 5 Aug 2025 23:18:47 +0200 Subject: [PATCH 1/2] avcodec/jpeg2000dec: move cdef default check into get_siz() This way cdef is at its final value earlier Signed-off-by: Michael Niedermayer --- libavcodec/jpeg2000dec.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 9a4afd37d0..aab48532ef 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -271,6 +271,17 @@ static int get_siz(Jpeg2000DecoderContext *s) return AVERROR_INVALIDDATA; } + for (i = 0; i < s->ncomponents; i++) { + if (s->cdef[i] < 0) { + for (i = 0; i < s->ncomponents; i++) { + s->cdef[i] = i + 1; + } + if ((s->ncomponents & 1) == 0) + s->cdef[s->ncomponents-1] = 0; + } + } + // after here we no longer have to consider negative cdef + for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i uint8_t x = bytestream2_get_byteu(&s->g); s->cbps[i] = (x & 0x7f) + 1; @@ -2885,17 +2896,6 @@ static int jpeg2000_decode_frame(AVCodecContext *avctx, AVFrame *picture, if (ret = jpeg2000_read_bitstream_packets(s)) goto end; - for (int x = 0; x < s->ncomponents; x++) { - if (s->cdef[x] < 0) { - for (x = 0; x < s->ncomponents; x++) { - s->cdef[x] = x + 1; - } - if ((s->ncomponents & 1) == 0) - s->cdef[s->ncomponents-1] = 0; - break; - } - } - for (int x = 0; x < s->ncomponents && s->codsty[x].transform == FF_DWT53;) if (++x == s->ncomponents) picture->flags |= AV_FRAME_FLAG_LOSSLESS; -- 2.49.1 >From b01cfe3d2b5e7e02e0ae0c079c31ee8a56201f30 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 5 Aug 2025 23:42:23 +0200 Subject: [PATCH 2/2] avcodec/jpeg2000dec: implement cdef remapping during pixel format matching Fixes: out of array access Fixes: poc.jp2 Found-by: Andy Nguyen Signed-off-by: Michael Niedermayer --- libavcodec/jpeg2000dec.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index aab48532ef..59f3133d1f 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -282,6 +282,14 @@ static int get_siz(Jpeg2000DecoderContext *s) } // after here we no longer have to consider negative cdef + int cdef_used = 0; + for (i = 0; i < s->ncomponents; i++) + cdef_used |= 1<cdef[i]; + + // Check that the channels we have are what we expect for the number of components + if (cdef_used != ((int[]){0,2,3,14,15})[s->ncomponents]) + return AVERROR_INVALIDDATA; + for (i = 0; i < s->ncomponents; i++) { // Ssiz_i XRsiz_i, YRsiz_i uint8_t x = bytestream2_get_byteu(&s->g); s->cbps[i] = (x & 0x7f) + 1; @@ -294,7 +302,9 @@ static int get_siz(Jpeg2000DecoderContext *s) av_log(s->avctx, AV_LOG_ERROR, "Invalid sample separation %d/%d\n", s->cdx[i], s->cdy[i]); return AVERROR_INVALIDDATA; } - log2_chroma_wh |= s->cdy[i] >> 1 << i * 4 | s->cdx[i] >> 1 << i * 4 + 2; + int i_remapped = s->cdef[i] ? s->cdef[i]-1 : (s->ncomponents-1); + + log2_chroma_wh |= s->cdy[i] >> 1 << i_remapped * 4 | s->cdx[i] >> 1 << i_remapped * 4 + 2; } s->numXtiles = ff_jpeg2000_ceildiv(s->width - s->tile_offset_x, s->tile_width); -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".