eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-18 13:00:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/jpegxl_parser: check ANS cluster alphabet size vs bundle size

Browse Source 
The specification doesn't mention that clusters cannot have alphabet
sizes greater than 1 << bundle->log_alphabet_size, but the reference
implementation rejects these entropy streams as invalid, so we should
too. Refusing to do so can overflow a stack variable that should be
large enough otherwise.

Fixes #10738.

Found-by: Zeng Yunxiang and Li Zeyuan
Signed-off-by: Leo Izen <leo.izen@gmail.com>
This commit is contained in:
Leo Izen
2023-12-22 21:50:44 -05:00
parent a888d21c8c
commit 1a3ec3f2f8
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/jpegxl_parser.c
View File

@@ -384,11 +384,11 @@ static int populate_distribution(GetBitContext *gb, JXLSymbolDistribution *dist,
uint32_t total_count = 0; uint32_t total_count = 0;
uint8_t logcounts[258] = { 0 }; uint8_t logcounts[258] = { 0 };
uint8_t same[258] = { 0 }; uint8_t same[258] = { 0 };
const int table_size = 1 << log_alphabet_size;
dist->uniq_pos = -1; dist->uniq_pos = -1;
if (get_bits1(gb)) { if (get_bits1(gb)) {
/* simple code */ /* simple code */
dist->alphabet_size = 256;
if (get_bits1(gb)) { if (get_bits1(gb)) {
uint8_t v1 = jxl_u8(gb); uint8_t v1 = jxl_u8(gb);
uint8_t v2 = jxl_u8(gb); uint8_t v2 = jxl_u8(gb);
@@ -398,17 +398,24 @@ static int populate_distribution(GetBitContext *gb, JXLSymbolDistribution *dist,
dist->freq[v2] = (1 << 12) - dist->freq[v1]; dist->freq[v2] = (1 << 12) - dist->freq[v1];
if (!dist->freq[v1]) if (!dist->freq[v1])
dist->uniq_pos = v2; dist->uniq_pos = v2;
dist->alphabet_size = 1 + FFMAX(v1, v2);
} else { } else {
uint8_t x = jxl_u8(gb); uint8_t x = jxl_u8(gb);
dist->freq[x] = 1 << 12; dist->freq[x] = 1 << 12;
dist->uniq_pos = x; dist->uniq_pos = x;
dist->alphabet_size = 1 + x;
} }
if (dist->alphabet_size > table_size)
return AVERROR_INVALIDDATA;
return 0; return 0;
} }
if (get_bits1(gb)) { if (get_bits1(gb)) {
/* flat code */ /* flat code */
dist->alphabet_size = jxl_u8(gb) + 1; dist->alphabet_size = jxl_u8(gb) + 1;
if (dist->alphabet_size > table_size)
return AVERROR_INVALIDDATA;
for (int i = 0; i < dist->alphabet_size; i++) for (int i = 0; i < dist->alphabet_size; i++)
dist->freq[i] = (1 << 12) / dist->alphabet_size; dist->freq[i] = (1 << 12) / dist->alphabet_size;
for (int i = 0; i < (1 << 12) % dist->alphabet_size; i++) for (int i = 0; i < (1 << 12) % dist->alphabet_size; i++)
@@ -426,6 +433,9 @@ static int populate_distribution(GetBitContext *gb, JXLSymbolDistribution *dist,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
dist->alphabet_size = jxl_u8(gb) + 3; dist->alphabet_size = jxl_u8(gb) + 3;
if (dist->alphabet_size > table_size)
return AVERROR_INVALIDDATA;
for (int i = 0; i < dist->alphabet_size; i++) { for (int i = 0; i < dist->alphabet_size; i++) {
logcounts[i] = get_vlc2(gb, dist_prefix_table, 7, 1); logcounts[i] = get_vlc2(gb, dist_prefix_table, 7, 1);
if (logcounts[i] == 13) { if (logcounts[i] == 13) {