PR #22515 opened by osamu620
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22515
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22515.patch

This commit fixes undefined behavior when the internal precision of the decoded 
coefficients within a codeblock exceeds the supported 32-bit range during ROI 
shift-up.


>From 593082ec7df17e9a94d0a0b644501a28122011eb Mon Sep 17 00:00:00 2001
From: Osamu Watanabe <[email protected]>
Date: Mon, 16 Mar 2026 13:43:42 +0900
Subject: [PATCH] avcodec/jpeg2000: Fix undefined behavior on ROI shift-up

---
 libavcodec/jpeg2000htdec.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/libavcodec/jpeg2000htdec.c b/libavcodec/jpeg2000htdec.c
index 9fc269306d..14ecd9814c 100644
--- a/libavcodec/jpeg2000htdec.c
+++ b/libavcodec/jpeg2000htdec.c
@@ -1334,8 +1334,19 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext 
*s, Jpeg2000CodingStyle *c
             sign = val & INT32_MIN;
             val &= INT32_MAX;
             /* ROI shift, if necessary */
-            if (roi_shift && (((uint32_t)val & ~mask) == 0))
-                val <<= roi_shift;
+            if (roi_shift && (((uint32_t)val & ~mask) == 0)) {
+                if ((32 - ff_clz(val | 1)) < roi_shift)
+                    // Assuming that the internal precision for codeblock 
decoding is 32 bits.
+                    val <<= roi_shift;
+                else {
+                    av_log(s->avctx, AV_LOG_ERROR, 
+                        "Pixel precision in ROI is beyond the supported 
range.\n"
+                    );
+                    ret = AVERROR_PATCHWELCOME;
+                    goto free;
+                }
+
+            }
             t1->data[n] = val | sign; /* NOTE: Binary point for reconstruction 
value is located in 31 - M_b */
         }
     }
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to