ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix various memory corruption issues in the new JPEG->YUV feature

Browse Source
This commit is contained in:
DRC
2010-12-11 06:01:11 +00:00
parent f54cc16225
commit 55a9cbffe7
1 changed files with 8 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
turbojpegl.c
View File

@@ -462,12 +462,9 @@ DLLEXPORT int DLLCALL tjDecompress(tjhandle h,
/dinfo->max_h_samp_factor; /dinfo->max_h_samp_factor;
ch[i]=PAD(height, dinfo->max_v_samp_factor)*compptr->v_samp_factor ch[i]=PAD(height, dinfo->max_v_samp_factor)*compptr->v_samp_factor
/dinfo->max_v_samp_factor; /dinfo->max_v_samp_factor;
if(iw[i]!=cw[i] || ih!=ch[i]) if(iw[i]!=cw[i] || ih!=ch[i]) usetmpbuf=1;
{ th[i]=compptr->v_samp_factor*DCTSIZE;
usetmpbuf=1;
th[i]=compptr->v_samp_factor*DCTSIZE/dinfo->max_v_samp_factor;
tmpbufsize+=iw[i]*th[i]; tmpbufsize+=iw[i]*th[i];
}
if((outbuf[i]=(JSAMPROW *)malloc(sizeof(JSAMPROW)*ch[i]))==NULL) if((outbuf[i]=(JSAMPROW *)malloc(sizeof(JSAMPROW)*ch[i]))==NULL)
_throw("Memory allocation failed in tjInitDecompress()"); _throw("Memory allocation failed in tjInitDecompress()");
for(row=0; row<ch[i]; row++) for(row=0; row<ch[i]; row++)
@@ -533,12 +530,13 @@ DLLEXPORT int DLLCALL tjDecompress(tjhandle h,
row+=dinfo->max_v_samp_factor*DCTSIZE) row+=dinfo->max_v_samp_factor*DCTSIZE)
{ {
JSAMPARRAY yuvptr[MAX_COMPONENTS]; JSAMPARRAY yuvptr[MAX_COMPONENTS];
int crow[MAX_COMPONENTS];
for(i=0; i<dinfo->num_components; i++) for(i=0; i<dinfo->num_components; i++)
{ {
jpeg_component_info *compptr=&dinfo->comp_info[i]; jpeg_component_info *compptr=&dinfo->comp_info[i];
crow[i]=row*compptr->v_samp_factor/dinfo->max_v_samp_factor;
if(usetmpbuf) yuvptr[i]=tmpbuf[i]; if(usetmpbuf) yuvptr[i]=tmpbuf[i];
else yuvptr[i]=&outbuf[i][row*compptr->v_samp_factor else yuvptr[i]=&outbuf[i][crow[i]];
/dinfo->max_v_samp_factor];
} }
jpeg_read_raw_data(dinfo, yuvptr, dinfo->max_v_samp_factor*DCTSIZE); jpeg_read_raw_data(dinfo, yuvptr, dinfo->max_v_samp_factor*DCTSIZE);
if(usetmpbuf) if(usetmpbuf)
@@ -547,10 +545,9 @@ DLLEXPORT int DLLCALL tjDecompress(tjhandle h,
for(i=0; i<dinfo->num_components; i++) for(i=0; i<dinfo->num_components; i++)
{ {
jpeg_component_info *compptr=&dinfo->comp_info[i]; jpeg_component_info *compptr=&dinfo->comp_info[i];
for(j=0; j<min(th[i], dinfo->output_height-row); j++) for(j=0; j<min(th[i], ch[i]-crow[i]); j++)
{ {
memcpy(outbuf[i][row*compptr->v_samp_factor memcpy(outbuf[i][crow[i]+j], tmpbuf[i][j], cw[i]);
/dinfo->max_v_samp_factor+j], tmpbuf[i][j], cw[i]);
} }
} }
} }