virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/jpegxl_parser: add sanity check for frame size

Browse Source 
If a frame size is absolutely massive, this can spin the parser as it
attempts to decode a permuted TOC. We add a sanity check here for eight
times the size of the image for an internal frame to prevent malicious
bitstreams from slowing the parser down to a crawl.

Signed-off-by: Leo Izen <leo.izen@gmail.com>
Reported-by: Kacper Michajłow <kasper93@gmail.com>
This commit is contained in:
Leo Izen
2025-07-15 13:54:05 -04:00
parent 3f2b452a22
commit 829680f96a
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/jpegxl_parser.c
View File

@ -1315,6 +1315,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
if (get_bits1(gb)) { if (get_bits1(gb)) {
JXLEntropyDecoder dec; JXLEntropyDecoder dec;
int64_t end, lehmer = 0; int64_t end, lehmer = 0;
/* parser sanity check to prevent TOC perm from spinning cpu */
if (width > meta->coded_width * 8 || height > meta->coded_height * 8) {
av_log(avctx, AV_LOG_WARNING, "frame of size %" PRIu32 "x%" PRIu32
" exceeds max size of %" PRIu32 "x%" PRIu32 ", aborting parser\n",
width, height, meta->coded_width * 8, meta->coded_height * 8);
return AVERROR_INVALIDDATA;
}
ret = entropy_decoder_init(avctx, gb, &dec, 8); ret = entropy_decoder_init(avctx, gb, &dec, 8);
if (ret < 0) if (ret < 0)
return ret; return ret;
@ -1331,7 +1338,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext *
lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer));
if (lehmer < 0 || get_bits_left(gb) < 0) { if (lehmer < 0 || get_bits_left(gb) < 0) {
entropy_decoder_close(&dec); entropy_decoder_close(&dec);
return AVERROR_BUFFER_TOO_SMALL; return lehmer < 0 ? lehmer : AVERROR_BUFFER_TOO_SMALL;
} }
} }
entropy_decoder_close(&dec); entropy_decoder_close(&dec);