diff --git a/java/TJUnitTest.java b/java/TJUnitTest.java index 7baef6e7..c64c21f0 100644 --- a/java/TJUnitTest.java +++ b/java/TJUnitTest.java @@ -864,34 +864,46 @@ final class TJUnitTest { try { exception = false; - size = TJ.bufSize(26755, 26755, TJ.SAMP_444); + size = TJ.bufSize(18919, 18919, TJ.SAMP_444); } catch (Exception e) { exception = true; } if (!exception || size != 0) throw new Exception("TJ.bufSize() overflow"); try { exception = false; - size = TJ.bufSizeYUV(37838, 1, 37838, TJ.SAMP_444); + size = TJ.bufSizeYUV(26755, 1, 26755, TJ.SAMP_444); } catch (Exception e) { exception = true; } if (!exception || size != 0) throw new Exception("TJ.bufSizeYUV() overflow"); try { exception = false; - size = TJ.bufSizeYUV(37837, 3, 37837, TJ.SAMP_444); + size = TJ.bufSizeYUV(26754, 3, 26754, TJ.SAMP_444); } catch (Exception e) { exception = true; } if (!exception || size != 0) throw new Exception("TJ.bufSizeYUV() overflow"); try { exception = false; - size = TJ.bufSizeYUV(37837, -1, 37837, TJ.SAMP_444); + size = TJ.bufSizeYUV(26754, -1, 26754, TJ.SAMP_444); } catch (Exception e) { exception = true; } if (!exception || size != 0) throw new Exception("TJ.bufSizeYUV() overflow"); try { exception = false; - size = TJ.planeSizeYUV(0, 65536, 0, 65536, TJ.SAMP_444); + size = TJ.planeSizeYUV(0, 46341, 0, 46341, TJ.SAMP_444); } catch (Exception e) { exception = true; } if (!exception || size != 0) throw new Exception("TJ.planeSizeYUV() overflow"); + try { + exception = false; + size = TJ.planeWidth(0, Integer.MAX_VALUE, TJ.SAMP_420); + } catch (Exception e) { exception = true; } + if (!exception || size != 0) + throw new Exception("TJ.planeWidth() overflow"); + try { + exception = false; + size = TJ.planeHeight(0, Integer.MAX_VALUE, TJ.SAMP_420); + } catch (Exception e) { exception = true; } + if (!exception || size != 0) + throw new Exception("TJ.planeHeight() overflow"); } static void bufSizeTest() throws Exception { diff --git a/tjunittest.c b/tjunittest.c index a44d66d7..98f270d8 100644 --- a/tjunittest.c +++ b/tjunittest.c @@ -38,6 +38,7 @@ #include #include #include +#include #include #include "tjutil.h" #include "turbojpeg.h" @@ -595,11 +596,16 @@ bailout: THROW(#function " overflow"); \ } #endif +#define CHECKSIZEINT(function) { \ + if (intsize != -1 || !strcmp(tjGetErrorStr2(NULL), "No error")) \ + THROW(#function " overflow"); \ +} static void overflowTest(void) { /* Ensure that the various buffer size functions don't overflow */ unsigned long size; + int intsize; size = tjBufSize(26755, 26755, TJSAMP_444); CHECKSIZE(tjBufSize()); @@ -617,6 +623,10 @@ static void overflowTest(void) CHECKSIZE(tjBufSizeYUV()); size = tjPlaneSizeYUV(0, 65536, 0, 65536, TJSAMP_444); CHECKSIZE(tjPlaneSizeYUV()); + intsize = tjPlaneWidth(0, INT_MAX, TJSAMP_420); + CHECKSIZEINT(tjPlaneWidth()); + intsize = tjPlaneHeight(0, INT_MAX, TJSAMP_420); + CHECKSIZEINT(tjPlaneHeight()); bailout: return; diff --git a/turbojpeg-jni.c b/turbojpeg-jni.c index 01eb312d..aa6611ef 100644 --- a/turbojpeg-jni.c +++ b/turbojpeg-jni.c @@ -26,6 +26,7 @@ * POSSIBILITY OF SUCH DAMAGE. */ +#include #include "turbojpeg.h" #include "jinclude.h" #include @@ -135,7 +136,7 @@ JNIEXPORT jint JNICALL Java_org_libjpegturbo_turbojpeg_TJ_bufSize unsigned long retval = tjBufSize(width, height, jpegSubsamp); if (retval == (unsigned long)-1) THROW_ARG(tjGetErrorStr()); - if (retval > (unsigned long)((unsigned int)-1)) + if (retval > (unsigned long)INT_MAX) THROW_ARG("Image is too large"); bailout: @@ -149,7 +150,7 @@ JNIEXPORT jint JNICALL Java_org_libjpegturbo_turbojpeg_TJ_bufSizeYUV__IIII unsigned long retval = tjBufSizeYUV2(width, align, height, subsamp); if (retval == (unsigned long)-1) THROW_ARG(tjGetErrorStr()); - if (retval > (unsigned long)((unsigned int)-1)) + if (retval > (unsigned long)INT_MAX) THROW_ARG("Image is too large"); bailout: @@ -165,7 +166,7 @@ JNIEXPORT jint JNICALL Java_org_libjpegturbo_turbojpeg_TJ_planeSizeYUV__IIIII subsamp); if (retval == (unsigned long)-1) THROW_ARG(tjGetErrorStr()); - if (retval > (unsigned long)((unsigned int)-1)) + if (retval > (unsigned long)INT_MAX) THROW_ARG("Image is too large"); bailout: diff --git a/turbojpeg.c b/turbojpeg.c index 1b01a579..fa25a3ac 100644 --- a/turbojpeg.c +++ b/turbojpeg.c @@ -31,6 +31,7 @@ libjpeg-turbo */ #include +#include #include #define JPEG_INTERNALS #include @@ -640,7 +641,8 @@ DLLEXPORT unsigned long TJBUFSIZEYUV(int width, int height, int subsamp) /* TurboJPEG 1.4+ */ DLLEXPORT int tjPlaneWidth(int componentID, int width, int subsamp) { - int pw, nc, retval = 0; + unsigned long long pw, retval = 0; + int nc; if (width < 1 || subsamp < 0 || subsamp >= TJ_NUMSAMP) THROWG("tjPlaneWidth(): Invalid argument"); @@ -648,21 +650,25 @@ DLLEXPORT int tjPlaneWidth(int componentID, int width, int subsamp) if (componentID < 0 || componentID >= nc) THROWG("tjPlaneWidth(): Invalid argument"); - pw = PAD(width, tjMCUWidth[subsamp] / 8); + pw = PAD((unsigned long long)width, tjMCUWidth[subsamp] / 8); if (componentID == 0) retval = pw; else retval = pw * 8 / tjMCUWidth[subsamp]; + if (retval > (unsigned long long)INT_MAX) + THROWG("tjPlaneWidth(): Width is too large"); + bailout: - return retval; + return (int)retval; } /* TurboJPEG 1.4+ */ DLLEXPORT int tjPlaneHeight(int componentID, int height, int subsamp) { - int ph, nc, retval = 0; + unsigned long long ph, retval = 0; + int nc; if (height < 1 || subsamp < 0 || subsamp >= TJ_NUMSAMP) THROWG("tjPlaneHeight(): Invalid argument"); @@ -670,14 +676,17 @@ DLLEXPORT int tjPlaneHeight(int componentID, int height, int subsamp) if (componentID < 0 || componentID >= nc) THROWG("tjPlaneHeight(): Invalid argument"); - ph = PAD(height, tjMCUHeight[subsamp] / 8); + ph = PAD((unsigned long long)height, tjMCUHeight[subsamp] / 8); if (componentID == 0) retval = ph; else retval = ph * 8 / tjMCUHeight[subsamp]; + if (retval > (unsigned long long)INT_MAX) + THROWG("tjPlaneHeight(): Height is too large"); + bailout: - return retval; + return (int)retval; }