ffmpeg | branch: release/7.0 | Leo Izen <leo.i...@gmail.com> | Tue Jul 15 13:54:05 2025 -0400| [206a89d4b08afe3c5b8a3ece80ff362b98c95c32] | committer: Michael Niedermayer
avcodec/jpegxl_parser: add sanity check for frame size If a frame size is absolutely massive, this can spin the parser as it attempts to decode a permuted TOC. We add a sanity check here for eight times the size of the image for an internal frame to prevent malicious bitstreams from slowing the parser down to a crawl. Signed-off-by: Leo Izen <leo.i...@gmail.com> Reported-by: Kacper Michajłow <kaspe...@gmail.com> (cherry picked from commit 829680f96a7a7ff02d1543895ec0fb713309d5c0) Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=206a89d4b08afe3c5b8a3ece80ff362b98c95c32 --- libavcodec/jpegxl_parser.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c index 76122af54a..a2591ffc0d 100644 --- a/libavcodec/jpegxl_parser.c +++ b/libavcodec/jpegxl_parser.c @@ -1315,6 +1315,13 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * if (get_bits1(gb)) { JXLEntropyDecoder dec; int64_t end, lehmer = 0; + /* parser sanity check to prevent TOC perm from spinning cpu */ + if (width > meta->coded_width * 8 || height > meta->coded_height * 8) { + av_log(avctx, AV_LOG_WARNING, "frame of size %" PRIu32 "x%" PRIu32 + " exceeds max size of %" PRIu32 "x%" PRIu32 ", aborting parser\n", + width, height, meta->coded_width * 8, meta->coded_height * 8); + return AVERROR_INVALIDDATA; + } ret = entropy_decoder_init(avctx, gb, &dec, 8); if (ret < 0) return ret; @@ -1331,7 +1338,7 @@ static int parse_frame_header(void *avctx, JXLParseContext *ctx, GetBitContext * lehmer = entropy_decoder_read_symbol(gb, &dec, toc_context(lehmer)); if (lehmer < 0 || get_bits_left(gb) < 0) { entropy_decoder_close(&dec); - return AVERROR_BUFFER_TOO_SMALL; + return lehmer < 0 ? lehmer : AVERROR_BUFFER_TOO_SMALL; } } entropy_decoder_close(&dec); _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
