ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix a really subtle issue whereby an invalid free() could occur if a program called tjInitDecompress() and then accidentally passed the handle to tjEncodeYUV3(), or if a program called tjInitCompress() and then accidentally passed the handle to tjDecompressToYUV2().

Browse Source
This commit is contained in:
DRC
2013-10-30 22:21:06 +00:00
parent 811d68b21b
commit 07eadec225
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
turbojpeg.c
View File

@@ -710,16 +710,16 @@ DLLEXPORT int DLLCALL tjEncodeYUV3(tjhandle handle, unsigned char *srcBuf,
unsigned char *rgbBuf=NULL;
#endif
getinstance(handle);
if((this->init&COMPRESS)==0)
_throw("tjEncodeYUV3(): Instance has not been initialized for compression");
for(i=0; i<MAX_COMPONENTS; i++)
{
tmpbuf[i]=NULL; _tmpbuf[i]=NULL;
tmpbuf2[i]=NULL; _tmpbuf2[i]=NULL; outbuf[i]=NULL;
}
getinstance(handle);
if((this->init&COMPRESS)==0)
_throw("tjEncodeYUV3(): Instance has not been initialized for compression");
if(srcBuf==NULL || width<=0 || pitch<0 || height<=0 || pixelFormat<0
|| pixelFormat>=TJ_NUMPF || dstBuf==NULL || pad<0 || !isPow2(pad)
|| subsamp<0 || subsamp>=NUMSUBOPT)
@@ -1105,15 +1105,15 @@ DLLEXPORT int DLLCALL tjDecompressToYUV2(tjhandle handle,
JSAMPLE *_tmpbuf=NULL, *ptr=dstBuf; JSAMPROW *tmpbuf[MAX_COMPONENTS];
int dctsize;
getinstance(handle);
if((this->init&DECOMPRESS)==0)
_throw("tjDecompressToYUV2(): Instance has not been initialized for decompression");
for(i=0; i<MAX_COMPONENTS; i++)
{
tmpbuf[i]=NULL; outbuf[i]=NULL;
}
getinstance(handle);
if((this->init&DECOMPRESS)==0)
_throw("tjDecompressToYUV2(): Instance has not been initialized for decompression");
if(jpegBuf==NULL || jpegSize<=0 || dstBuf==NULL || width<0 || pad<1
|| !isPow2(pad) || height<0)
_throw("tjDecompressToYUV2(): Invalid argument");