PR #22515 opened by osamu620 URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22515 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22515.patch
This commit fixes undefined behavior when the internal precision of the decoded coefficients within a codeblock exceeds the supported 32-bit range during ROI shift-up. >From 593082ec7df17e9a94d0a0b644501a28122011eb Mon Sep 17 00:00:00 2001 From: Osamu Watanabe <[email protected]> Date: Mon, 16 Mar 2026 13:43:42 +0900 Subject: [PATCH] avcodec/jpeg2000: Fix undefined behavior on ROI shift-up --- libavcodec/jpeg2000htdec.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/libavcodec/jpeg2000htdec.c b/libavcodec/jpeg2000htdec.c index 9fc269306d..14ecd9814c 100644 --- a/libavcodec/jpeg2000htdec.c +++ b/libavcodec/jpeg2000htdec.c @@ -1334,8 +1334,19 @@ ff_jpeg2000_decode_htj2k(const Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c sign = val & INT32_MIN; val &= INT32_MAX; /* ROI shift, if necessary */ - if (roi_shift && (((uint32_t)val & ~mask) == 0)) - val <<= roi_shift; + if (roi_shift && (((uint32_t)val & ~mask) == 0)) { + if ((32 - ff_clz(val | 1)) < roi_shift) + // Assuming that the internal precision for codeblock decoding is 32 bits. + val <<= roi_shift; + else { + av_log(s->avctx, AV_LOG_ERROR, + "Pixel precision in ROI is beyond the supported range.\n" + ); + ret = AVERROR_PATCHWELCOME; + goto free; + } + + } t1->data[n] = val | sign; /* NOTE: Binary point for reconstruction value is located in 31 - M_b */ } } -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
