From 78962d3df49afe5011b572656ecfe940bd5fbf2e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 1 Jul 2013 10:01:11 +0200 Subject: [PATCH 1/2] jpeg2000: Check that nreslevels2decode has been initialized before use Avoid buffer overread. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Luca Barbato --- libavcodec/jpeg2000.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/jpeg2000.c b/libavcodec/jpeg2000.c index 705399ab0c..5889f80576 100644 --- a/libavcodec/jpeg2000.c +++ b/libavcodec/jpeg2000.c @@ -206,6 +206,11 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp, int reslevelno, bandno, gbandno = 0, ret, i, j; uint32_t csize = 1; + if (!codsty->nreslevels2decode) { + av_log(avctx, AV_LOG_ERROR, "nreslevels2decode uninitialized\n"); + return AVERROR_INVALIDDATA; + } + if (ret = ff_jpeg2000_dwt_init(&comp->dwt, comp->coord, codsty->nreslevels2decode - 1, codsty->transform)) From ef35d6dbc6c3b7ba6b13ac13fc8e797cc1268c8f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 1 Jul 2013 10:01:12 +0200 Subject: [PATCH 2/2] jpeg2000: Propagate error code from get_cox() Signed-off-by: Michael Niedermayer Signed-off-by: Luca Barbato --- libavcodec/jpeg2000dec.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index af464be65c..86ccad0881 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -330,7 +330,7 @@ static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c, uint8_t *properties) { Jpeg2000CodingStyle tmp; - int compno; + int compno, ret; if (bytestream2_get_bytes_left(&s->g) < 5) return AVERROR_INVALIDDATA; @@ -343,7 +343,9 @@ static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c, tmp.nlayers = bytestream2_get_be16u(&s->g); tmp.mct = bytestream2_get_byteu(&s->g); // multiple component transformation - get_cox(s, &tmp); + if ((ret = get_cox(s, &tmp)) < 0) + return ret; + for (compno = 0; compno < s->ncomponents; compno++) if (!(properties[compno] & HAD_COC)) memcpy(c + compno, &tmp, sizeof(tmp)); @@ -355,7 +357,7 @@ static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c, static int get_coc(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c, uint8_t *properties) { - int compno; + int compno, ret; if (bytestream2_get_bytes_left(&s->g) < 2) return AVERROR_INVALIDDATA; @@ -371,7 +373,9 @@ static int get_coc(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c, c += compno; c->csty = bytestream2_get_byteu(&s->g); - get_cox(s, c); + + if ((ret = get_cox(s, c)) < 0) + return ret; properties[compno] |= HAD_COC; return 0;