[FFmpeg-cvslog] avformat/jpegxl_anim_dec: fix out of array read using buffer padding

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Sun Jun 18 23:50:18 2023 +0200| [6a9d13acc26bf02a33b9b8b836bed26d9d43f303] | committer: Leo Izen

avformat/jpegxl_anim_dec: fix out of array read using buffer padding

Fixes: out of array read
Fixes: 59828/clusterfuzz-testcase-minimized-ffmpeg_dem_JPEGXL_ANIM_fuzzer-5029813220671488

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6a9d13acc26bf02a33b9b8b836bed26d9d43f303
---

 libavformat/jpegxl_anim_dec.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/libavformat/jpegxl_anim_dec.c b/libavformat/jpegxl_anim_dec.c
index 8d6ea5005c..956b56c1d8 100644
--- a/libavformat/jpegxl_anim_dec.c
+++ b/libavformat/jpegxl_anim_dec.c
@@ -112,7 +112,7 @@ static int jpegxl_collect_codestream_header(const uint8_t *input_buffer, int inp
 
 static int jpegxl_anim_probe(const AVProbeData *p)
 {
-    uint8_t buffer[4096];
+    uint8_t buffer[4096 + AV_INPUT_BUFFER_PADDING_SIZE];
     int copied;
 
     /* this is a raw codestream */
@@ -127,7 +127,7 @@ static int jpegxl_anim_probe(const AVProbeData *p)
     if (AV_RL64(p->buf) != FF_JPEGXL_CONTAINER_SIGNATURE_LE)
         return 0;
 
-    if (jpegxl_collect_codestream_header(p->buf, p->buf_size, buffer, sizeof(buffer), &copied) <= 0 || copied <= 0)
+    if (jpegxl_collect_codestream_header(p->buf, p->buf_size, buffer, sizeof(buffer) - AV_INPUT_BUFFER_PADDING_SIZE, &copied) <= 0 || copied <= 0)
         return 0;
 
     if (ff_jpegxl_verify_codestream_header(buffer, copied, 0) >= 1)
@@ -142,7 +142,8 @@ static int jpegxl_anim_read_header(AVFormatContext *s)
     AVIOContext *pb = s->pb;
     AVStream *st;
     int offset = 0;
-    uint8_t head[256];
+    uint8_t head[256 + AV_INPUT_BUFFER_PADDING_SIZE];
+    const int sizeofhead = sizeof(head) - AV_INPUT_BUFFER_PADDING_SIZE;
     int headsize = 0;
     int ctrl;
     AVRational tb;
@@ -151,7 +152,7 @@ static int jpegxl_anim_read_header(AVFormatContext *s)
     uint64_t sig16 = avio_rl16(pb);
     if (sig16 == FF_JPEGXL_CODESTREAM_SIGNATURE_LE) {
         AV_WL16(head, sig16);
-        headsize = avio_read(s->pb, head + 2, sizeof(head) - 2);
+        headsize = avio_read(s->pb, head + 2, sizeofhead - 2);
         if (headsize < 0)
             return headsize;
         headsize += 2;
@@ -182,10 +183,10 @@ static int jpegxl_anim_read_header(AVFormatContext *s)
                 if (av_buffer_realloc(&ctx->initial, ctx->initial->size + read) < 0)
                     return AVERROR(ENOMEM);
             }
-            jpegxl_collect_codestream_header(buf, read, head + headsize, sizeof(head) - headsize, &copied);
+            jpegxl_collect_codestream_header(buf, read, head + headsize, sizeofhead - headsize, &copied);
             memcpy(ctx->initial->data + (ctx->initial->size - read), buf, read);
             headsize += copied;
-            if (headsize >= sizeof(head) || read < sizeof(buf))
+            if (headsize >= sizeofhead || read < sizeof(buf))
                 break;
         }
     }