On Tue, 15 Jul 2025 at 20:02, Leo Izen <[email protected]> wrote:
>
> If a frame size is absolutely massive, this can spin the parser as it
> attempts to decode a permuted TOC. We add a sanity check here for eight
> times the size of the image for an internal frame to prevent malicious
> bitstreams from slowing the parser down to a crawl.
>
> Signed-off-by: Leo Izen <[email protected]>
> Reported-by: Kacper Michajłow <[email protected]>
Please use my real email, instead this wrapped one, thanks.
> ---
> libavcodec/jpegxl_parser.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
> index 68404229a5..e40b4fbf96 100644
> --- a/libavcodec/jpegxl_parser.c
> +++ b/libavcodec/jpegxl_parser.c
> @@ -1315,6 +1315,11 @@ static int parse_frame_header(void *avctx,
> JXLParseContext *ctx, GetBitContext *
> if (get_bits1(gb)) {
> JXLEntropyDecoder dec;
> int64_t end, lehmer = 0;
> + /* parser sanity check to prevent TOC perm from spinning cpu */
> + if (width > meta->coded_width * 8 || height > meta->coded_height *
> 8) {
> + av_log(avctx, AV_LOG_WARNING, "massive frame detectived,
> aborting parser\n");
detected? Also maybe make it more formal like "frame of size %dx%d
exceeds limit of %dx%d, aborting" or something along those lines.
"massive frame" doesn't really tell much.
- Kacper
_______________________________________________
ffmpeg-devel mailing list
[email protected]
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
[email protected] with subject "unsubscribe".
