diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2017-11-18 01:33:18 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-11-22 13:06:50 +0100 |
| commit | 3d5822d9cf07d08bce82903e4715658f46b01b5c (patch) | |
| tree | a660d16797efc73b3a7cd35e41b09fa15c38a5e8 /libavcodec/jpeg2000.c | |
| parent | e8e9306b4f0017c3d2ae2a9f02136279c1a105e9 (diff) | |
avcodec/jpeg2000: Dynamically allocate codeblock data
Fixes: OOM
Fixes: 3541/clusterfuzz-testcase-minimized-6469958596820992
Adds support for decoding codeblock data larger than 8kb
Reduces decoder memory consumption
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/jpeg2000.c')
| -rw-r--r-- | libavcodec/jpeg2000.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/libavcodec/jpeg2000.c b/libavcodec/jpeg2000.c index afeb9df27c..8551cf8d6c 100644 --- a/libavcodec/jpeg2000.c +++ b/libavcodec/jpeg2000.c @@ -357,7 +357,6 @@ static int init_prec(Jpeg2000Band *band, comp->reslevel[reslevelno-1].coord[1][0]; } - cblk->zero = 0; cblk->lblock = 3; cblk->length = 0; memset(cblk->lengthinc, 0, sizeof(cblk->lengthinc)); @@ -598,9 +597,18 @@ void ff_jpeg2000_cleanup(Jpeg2000Component *comp, Jpeg2000CodingStyle *codsty) for (precno = 0; precno < reslevel->num_precincts_x * reslevel->num_precincts_y; precno++) { if (band->prec) { Jpeg2000Prec *prec = band->prec + precno; + int nb_code_blocks = prec->nb_codeblocks_height * prec->nb_codeblocks_width; + av_freep(&prec->zerobits); av_freep(&prec->cblkincl); - av_freep(&prec->cblk); + if (prec->cblk) { + int cblkno; + for (cblkno = 0; cblkno < nb_code_blocks; cblkno ++) { + Jpeg2000Cblk *cblk = &prec->cblk[cblkno]; + av_freep(&cblk->data); + } + av_freep(&prec->cblk); + } } } |