virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/jpeg2000dec: Reduce the number of tile parts allocated

Browse Source 
This is large enough for all jpeg2000 files i tested. If some need more then this
should be changed to dynamic allocation. Dynamic allocation would need to be done
carefully as these are many relatively small arrays so repeatly reallocating them
would not be good.
The decrease is a clean and simple solution assuming it works for all files.

Fixes: OOM
Fixes: 6534/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4821490731057152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-05-04 18:28:07 +02:00
parent 0a47451458
commit 3543522d20
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/jpeg2000dec.c
View File

@ -82,7 +82,7 @@ typedef struct Jpeg2000Tile {
Jpeg2000CodingStyle codsty[4];
Jpeg2000QuantStyle qntsty[4];
Jpeg2000POC poc;
Jpeg2000TilePart tile_part[256];
Jpeg2000TilePart tile_part[32];
uint16_t tp_idx; // Tile-part index
int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
} Jpeg2000Tile;
@ -761,7 +761,10 @@ static int get_sot(Jpeg2000DecoderContext *s, int n)
return AVERROR_INVALIDDATA;
}
av_assert0(TPsot < FF_ARRAY_ELEMS(s->tile[Isot].tile_part));
if (TPsot >= FF_ARRAY_ELEMS(s->tile[Isot].tile_part)) {
avpriv_request_sample(s->avctx, "Too many tile parts");
return AVERROR_PATCHWELCOME;
}
s->tile[Isot].tp_idx = TPsot;
tp = s->tile[Isot].tile_part + TPsot;