diff --git a/ChangeLog.txt b/ChangeLog.txt index 4de0955e..68261e8a 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -38,6 +38,14 @@ included a similar fix for ASCII PPM/PGM files. Note that these issues were not security bugs, since they were confined to the cjpeg program and did not affect any of the libjpeg-turbo libraries. +[7] Fixed an issue whereby attempting to decompress a JPEG file with a corrupt +header using the tjDecompressToYUV2() function would cause the function to +abort without returning an error and, under certain circumstances, corrupt the +stack. This only occurred if tjDecompressToYUV2() was called prior to calling +calling tjDecompressHeader3(), or if the return value from +tjDecompressHeader3() was ignored (both cases represent incorrect usage of the +TurboJPEG API.) + 1.4.2 ===== diff --git a/turbojpeg.c b/turbojpeg.c index b20272ae..d0e9704a 100644 --- a/turbojpeg.c +++ b/turbojpeg.c @@ -1886,6 +1886,12 @@ DLLEXPORT int DLLCALL tjDecompressToYUV2(tjhandle handle, || !isPow2(pad) || height<0) _throw("tjDecompressToYUV2(): Invalid argument"); + if(setjmp(this->jerr.setjmp_buffer)) + { + /* If we get here, the JPEG code has signaled an error. */ + return -1; + } + jpeg_mem_src_tj(dinfo, jpegBuf, jpegSize); jpeg_read_header(dinfo, TRUE); jpegSubsamp=getSubsamp(dinfo);