diff --git a/ChangeLog.txt b/ChangeLog.txt index 98481ec2..475d8309 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -30,6 +30,10 @@ so this was an attempt to make them happy. upper 64 bits of xmm6 and xmm7 on Win64 platforms, which violated the Win64 calling conventions. +[7] Fixed a regression caused by 1.2.0[6] in which decompressing corrupt JPEG +images (specifically, images in which the component count was erroneously set +to a large value) would cause libjpeg-turbo to segfault. + 1.2.0 ===== diff --git a/jdmarker.c b/jdmarker.c index d8dcba98..6fc0f7dc 100644 --- a/jdmarker.c +++ b/jdmarker.c @@ -323,14 +323,15 @@ get_sos (j_decompress_ptr cinfo) /* Collect the component-spec parameters */ - for (i = 0; i < cinfo->num_components; i++) + for (i = 0; i < MAX_COMPS_IN_SCAN; i++) cinfo->cur_comp_info[i] = NULL; for (i = 0; i < n; i++) { INPUT_BYTE(cinfo, cc, return FALSE); INPUT_BYTE(cinfo, c, return FALSE); - for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components; + for (ci = 0, compptr = cinfo->comp_info; + ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN; ci++, compptr++) { if (cc == compptr->component_id && !cinfo->cur_comp_info[ci]) goto id_found;