for (cblkno = 0; cblkno < nb_code_blocks; cblkno++) {
Jpeg2000Cblk *cblk = prec->cblk + cblkno;
int incl, newpasses, llen;
+ void *tmp;
if (cblk->npasses)
incl = get_bits(s, 1);
cblk->nb_lengthinc = 0;
cblk->nb_terminationsinc = 0;
+ av_free(cblk->lengthinc);
+ cblk->lengthinc = av_mallocz_array(newpasses , sizeof(*cblk->lengthinc));
+ if (!cblk->lengthinc)
+ return AVERROR(ENOMEM);
+ tmp = av_realloc_array(cblk->data_start, cblk->nb_terminations + newpasses + 1, sizeof(*cblk->data_start));
+ if (!tmp)
+ return AVERROR(ENOMEM);
+ cblk->data_start = tmp;
do {
int newpasses1 = 0;
if ((ret = get_bits(s, av_log2(newpasses1) + cblk->lblock)) < 0)
return ret;
- if (ret > sizeof(cblk->data)) {
+ if (ret > cblk->data_allocated) {
+ size_t new_size = FFMAX(2*cblk->data_allocated, ret);
+ void *new = av_realloc(cblk->data, new_size);
+ if (new) {
+ cblk->data = new;
+ cblk->data_allocated = new_size;
+ }
+ }
+ if (ret > cblk->data_allocated) {
avpriv_request_sample(s->avctx,
"Block with lengthinc greater than %"SIZE_SPECIFIER"",
- sizeof(cblk->data));
+ cblk->data_allocated);
return AVERROR_PATCHWELCOME;
}
cblk->lengthinc[cblk->nb_lengthinc++] = ret;
nb_code_blocks = prec->nb_codeblocks_height * prec->nb_codeblocks_width;
for (cblkno = 0; cblkno < nb_code_blocks; cblkno++) {
Jpeg2000Cblk *cblk = prec->cblk + cblkno;
+ if (!cblk->nb_terminationsinc && !cblk->lengthinc)
+ continue;
for (cwsno = 0; cwsno < cblk->nb_lengthinc; cwsno ++) {
+ if (cblk->data_allocated < cblk->length + cblk->lengthinc[cwsno] + 4) {
+ size_t new_size = FFMAX(2*cblk->data_allocated, cblk->length + cblk->lengthinc[cwsno] + 4);
+ void *new = av_realloc(cblk->data, new_size);
+ if (new) {
+ cblk->data = new;
+ cblk->data_allocated = new_size;
+ }
+ }
if ( bytestream2_get_bytes_left(&s->g) < cblk->lengthinc[cwsno]
- || sizeof(cblk->data) < cblk->length + cblk->lengthinc[cwsno] + 4
+ || cblk->data_allocated < cblk->length + cblk->lengthinc[cwsno] + 4
) {
av_log(s->avctx, AV_LOG_ERROR,
"Block length %"PRIu16" or lengthinc %d is too large, left %d\n",
cblk->data_start[cblk->nb_terminations] = cblk->length;
}
}
+ av_freep(&cblk->lengthinc);
}
}
return 0;
bytestream2_get_bytes_left(&s->g) >= 8) {
atom_size = bytestream2_get_be32u(&s->g);
atom = bytestream2_get_be32u(&s->g);
- atom_end = bytestream2_tell(&s->g) + atom_size - 8;
+ if (atom_size == 1) {
+ if (bytestream2_get_be32u(&s->g)) {
+ avpriv_request_sample(s->avctx, "Huge atom");
+ return 0;
+ }
+ atom_size = bytestream2_get_be32u(&s->g);
+ atom_end = bytestream2_tell(&s->g) + atom_size - 16;
+ } else {
+ atom_end = bytestream2_tell(&s->g) + atom_size - 8;
+ }
if (atom == JP2_CODESTREAM)
return 1;