[FFmpeg-cvslog] avcodec/jpeglsdec: force pal8 only once

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon May 10 21:36:18 2021 +0200| [864d1ef2fc88c300613a5a9f1465f98f3559110c] | committer: Michael Niedermayer

avcodec/jpeglsdec: force pal8 only once

Fixes: Infinite loop
Fixes: 33958/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_THP_fuzzer-6590264069193728
Fixes: 33981/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_JPEGLS_fuzzer-5343224173559808
Fixes: 33986/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MJPEG_fuzzer-6598815122587648
Fixes: 34001/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_SMVJPEG_fuzzer-6171098111672320

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=864d1ef2fc88c300613a5a9f1465f98f3559110c
---

 libavcodec/jpeglsdec.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index c61cb14f49..32c0d2eb3f 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -118,9 +118,12 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s)
                 shift = 8 - s->avctx->bits_per_raw_sample;
             }
 
-            s->force_pal8 = 1;
-            if (!pal)
+            s->force_pal8++;
+            if (!pal) {
+                if (s->force_pal8 > 1)
+                    return AVERROR_INVALIDDATA;
                 return 1;
+            }
 
             for (i=s->palette_index; i<=maxtab; i++) {
                 uint8_t k = i << shift;