From 16102cada5a7c6e0a2aa07b1d2ac24dabc2095d9 Mon Sep 17 00:00:00 2001 From: Shaun Simpson Date: Wed, 21 Jul 2021 14:15:45 +0100 Subject: [PATCH] avcodec/jpeg2000_parser: Fix skipping of JP2 info markers by correctly reading marker size Signed-off-by: Shaun Simpson --- libavcodec/jpeg2000_parser.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/libavcodec/jpeg2000_parser.c b/libavcodec/jpeg2000_parser.c index 6b72a06b30359..e6db7eefa8619 100644 --- a/libavcodec/jpeg2000_parser.c +++ b/libavcodec/jpeg2000_parser.c @@ -82,7 +82,7 @@ static int find_frame_end(JPEG2000ParserContext *m, const uint8_t *buf, int buf_ { ParseContext *pc= &m->pc; int i; - uint32_t state; + uint32_t state, next_state; uint64_t state64; state= pc->state; state64 = pc->state64; @@ -143,7 +143,17 @@ static int find_frame_end(JPEG2000ParserContext *m, const uint8_t *buf, int buf_ } else if (m->in_codestream && (state & 0xFFFF) == 0xFF90) { // Are we in tile part header? m->read_tp = 8; } else if (pc->frame_start_found && info_marker((state & 0xFFFF0000)>>16) && m->in_codestream) { - m->skip_bytes = (state & 0xFFFF) - 2; + // Calculate number of bytes to skip to get to end of the next marker. + m->skip_bytes = (state & 0xFFFF)-1; + + // If the next marker is an info marker, skip to the end of of the marker length. + if (i + m->skip_bytes + 1 < buf_size) { + next_state = (buf[i + m->skip_bytes] << 8) | buf[i + m->skip_bytes + 1]; + if (info_marker(next_state)) { + // Skip an additional 2 bytes to get to the end of the marker length. + m->skip_bytes += 2; + } + } } }