[FFmpeg-devel] [PATCH v2 1/3] avcodec/jpegxl_parse{, r}: use correct ISOBMFF extended size location

[Leo Izen]

According to ISO/IEC 14996-12, size == 1 means a 64-bit extended-size
field occurs *after* the 32-bit box type, not before. This fix should
allow correct parsing of JXL files with extended-size boxes.

Signed-off-by: Leo Izen <leo.izen at gmail.com>
---
 libavcodec/jpegxl_parse.c  | 6 +++---
 libavcodec/jpegxl_parser.c | 9 +++++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/libavcodec/jpegxl_parse.c b/libavcodec/jpegxl_parse.c
index eb28e80867..7cfdd3e7d5 100644
--- a/libavcodec/jpegxl_parse.c
+++ b/libavcodec/jpegxl_parse.c
@@ -462,8 +462,10 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l
             return AVERROR_BUFFER_TOO_SMALL;
 
         size = bytestream2_get_be32(&gb);
+        tag = bytestream2_get_le32(&gb);
+
         if (size == 1) {
-            if (bytestream2_get_bytes_left(&gb) < 12)
+            if (bytestream2_get_bytes_left(&gb) < 8)
                 return AVERROR_BUFFER_TOO_SMALL;
             size = bytestream2_get_be64(&gb);
             head_size = 16;
@@ -474,8 +476,6 @@ int ff_jpegxl_collect_codestream_header(const uint8_t *input_buffer, int input_l
         if (size)
             size -= head_size;
 
-        tag = bytestream2_get_le32(&gb);
-
         if (tag == MKTAG('j','x','l','p')) {
             uint32_t idx;
             if (bytestream2_get_bytes_left(&gb) < 4)
diff --git a/libavcodec/jpegxl_parser.c b/libavcodec/jpegxl_parser.c
index 630fc8a60b..750872f17f 100644
--- a/libavcodec/jpegxl_parser.c
+++ b/libavcodec/jpegxl_parser.c
@@ -1342,7 +1342,7 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size)
 
     while (1) {
         uint64_t size;
-        int head_size = 4;
+        int head_size = 8;
 
         if (bytestream2_peek_le16(&gb) == FF_JPEGXL_CODESTREAM_SIGNATURE_LE)
             break;
@@ -1353,16 +1353,17 @@ static int skip_boxes(JXLParseContext *ctx, const uint8_t *buf, int buf_size)
             return AVERROR_BUFFER_TOO_SMALL;
 
         size = bytestream2_get_be32(&gb);
+        bytestream2_skip(&gb, 4); // tag
         if (size == 1) {
-            if (bytestream2_get_bytes_left(&gb) < 12)
+            if (bytestream2_get_bytes_left(&gb) < 8)
                 return AVERROR_BUFFER_TOO_SMALL;
             size = bytestream2_get_be64(&gb);
-            head_size = 12;
+            head_size = 16;
         }
         if (!size)
             return AVERROR_INVALIDDATA;
         /* invalid ISOBMFF size */
-        if (size <= head_size + 4 || size > INT_MAX - ctx->skip)
+        if (size <= head_size || size > INT_MAX - ctx->skip)
             return AVERROR_INVALIDDATA;
 
         ctx->skip += size;
-- 
2.43.0