Out-of-bounds

libjxl b02d6b9, as used in libvips 8.11 through 8.11.2 and other products, has an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroup called from jxl::FrameDecoder::ProcessACGroup and jxl::ThreadPool::RunCallStatejxl::FrameDecoder::ProcessSections...

OSV-2021-1615 Heap-buffer-overflow in jxl::ModularFrameDecoder::DecodeGroup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41283 Crash type: Heap-buffer-overflow READ Crash state: jxl::ModularFrameDecoder::DecodeGroup jxl::FrameDecoder::ProcessACGroup jxl::ThreadPool::RunCallStatejxl::FrameDecoder::ProcessSections...