Commit 3543522d authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/jpeg2000dec: Reduce the number of tile parts allocated

This is large enough for all jpeg2000 files i tested. If some need more then this
should be changed to dynamic allocation. Dynamic allocation would need to be done
carefully as these are many relatively small arrays so repeatly reallocating them
would not be good.
The decrease is a clean and simple solution assuming it works for all files.

Fixes: OOM
Fixes: 6534/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEG2000_fuzzer-4821490731057152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpegSigned-off-by: 's avatarMichael Niedermayer <michael@niedermayer.cc>
parent 0a474514
......@@ -82,7 +82,7 @@ typedef struct Jpeg2000Tile {
Jpeg2000CodingStyle codsty[4];
Jpeg2000QuantStyle qntsty[4];
Jpeg2000POC poc;
Jpeg2000TilePart tile_part[256];
Jpeg2000TilePart tile_part[32];
uint16_t tp_idx; // Tile-part index
int coord[2][2]; // border coordinates {{x0, x1}, {y0, y1}}
} Jpeg2000Tile;
......@@ -761,7 +761,10 @@ static int get_sot(Jpeg2000DecoderContext *s, int n)
return AVERROR_INVALIDDATA;
}
av_assert0(TPsot < FF_ARRAY_ELEMS(s->tile[Isot].tile_part));
if (TPsot >= FF_ARRAY_ELEMS(s->tile[Isot].tile_part)) {
avpriv_request_sample(s->avctx, "Too many tile parts");
return AVERROR_PATCHWELCOME;
}
s->tile[Isot].tp_idx = TPsot;
tp = s->tile[Isot].tile_part + TPsot;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment