Commit 1080be2816 for ffmpeg
commit 1080be28164859f1ea6191c9cb304e1a2b2cb633
Author: zhang xingxing <2388969553@qq.com>
Date: Fri Nov 6 02:08:08 2026 +0100
avcodec/jpeg2000_parser: fix the tile-part length check
This is not a security issue.
Fixes: integer underflow
Fixes: kgusFCuY3WYo
Fixes: swarm-Unsigned-arithmetic-underflow-in-tile-part-skip_bytes-calculation-d23292
Found-by: zhang xingxing <2388969553@qq.com>
Merged frames Replicated through UnModified FFmpeg with ffprobe
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
diff --git a/libavcodec/jpeg2000_parser.c b/libavcodec/jpeg2000_parser.c
index a5dcc9c9f1..edf47934d5 100644
--- a/libavcodec/jpeg2000_parser.c
+++ b/libavcodec/jpeg2000_parser.c
@@ -122,7 +122,7 @@ static int find_frame_end(JPEG2000ParserContext *m, const uint8_t *buf, int buf_
}
if (m->read_tp) { // Find out how many bytes inside Tile part codestream to skip.
if (m->read_tp == 1) {
- m->skip_bytes = (state64 & 0xFFFFFFFF) - 9 > 0?
+ m->skip_bytes = (state64 & 0xFFFFFFFF) > 9 ?
(state64 & 0xFFFFFFFF) - 9 : 0;
}
m->read_tp--;