[FFmpeg-cvslog] jpeg2000: check log2_cblk dimensions

[Michael Niedermayer]

ffmpeg | branch: release/0.8 | Michael Niedermayer <michaelni at gmx.at> | Sat Aug 24 03:19:40 2013 +0200| [38ca79b04d9a16790be7941950152b514a237759] | committer: Michael Niedermayer

jpeg2000: check log2_cblk dimensions

Fixes out of array access
Fixes Ticket2895

Found-by: Piotr Bandurski <ami_stuff at o2.pl>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 9a271a9368eaabf99e6c2046103acb33957e63b7)

Conflicts:

	libavcodec/jpeg2000dec.c

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

Conflicts:

	libavcodec/j2kdec.c

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=38ca79b04d9a16790be7941950152b514a237759
---

 libavcodec/j2kdec.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/j2kdec.c b/libavcodec/j2kdec.c
index 3315a83..2b6929d 100644
--- a/libavcodec/j2kdec.c
+++ b/libavcodec/j2kdec.c
@@ -28,6 +28,7 @@
 #include "avcodec.h"
 #include "bytestream.h"
 #include "j2k.h"
+#include "libavutil/avassert.h"
 #include "libavutil/common.h"
 
 #define JP2_SIG_TYPE    0x6A502020
@@ -283,6 +284,10 @@ static int get_cox(J2kDecoderContext *s, J2kCodingStyle *c)
      c->log2_cblk_width = bytestream_get_byte(&s->buf) + 2; // cblk width
     c->log2_cblk_height = bytestream_get_byte(&s->buf) + 2; // cblk height
 
+    if (c->log2_cblk_width > 6 || c->log2_cblk_height > 6) {
+        return AVERROR_PATCHWELCOME;
+    }
+
     c->cblk_style = bytestream_get_byte(&s->buf);
     if (c->cblk_style != 0){ // cblk style
         av_log(s->avctx, AV_LOG_WARNING, "extra cblk styles %X\n", c->cblk_style);
@@ -699,6 +704,9 @@ static int decode_cblk(J2kDecoderContext *s, J2kCodingStyle *codsty, J2kT1Contex
     int bpass_csty_symbol = J2K_CBLK_BYPASS & codsty->cblk_style;
     int vert_causal_ctx_csty_symbol = J2K_CBLK_VSC & codsty->cblk_style;
 
+    av_assert0(width  <= J2K_MAX_CBLKW);
+    av_assert0(height <= J2K_MAX_CBLKH);
+
     for (y = 0; y < height+2; y++)
         memset(t1->flags[y], 0, (width+2)*sizeof(int));