ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TurboJPEG: Fix erroneous subsampling detection

Browse Source 
... that caused some JPEG images with unusual sampling factors to be
misidentified as 4:4:4.  This led to a buffer overflow when attempting
to decompress some such images using tjDecompressToYUV*().

Regression introduced by 479501b07c

The correct behavior is for the TurboJPEG API to refuse to decompress
such images, which it did prior to the aforementioned commit.

Fixes #389
This commit is contained in:
DRC
2019-11-15 13:29:11 -06:00
parent 6cedf37c83
commit c0b16e3d2b
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog.md
View File

@@ -18,6 +18,12 @@ occurred when attempting to decompress grayscale JPEG images that were
compressed with a sampling factor other than 1 (for instance, with compressed with a sampling factor other than 1 (for instance, with
`cjpeg -grayscale -sample 2x2`). `cjpeg -grayscale -sample 2x2`).
4. Fixed a regression introduced by 2.0.2[5] that caused the TurboJPEG API to
incorrectly identify some JPEG images with unusual sampling factors as 4:4:4
JPEG images. This was known to cause a buffer overflow when attempting to
decompress some such images using `tjDecompressToYUV2()` or
`tjDecompressToYUVPlanes()`.
2.0.3 2.0.3
===== =====

4
turbojpeg.c
View File

@@ -368,9 +368,9 @@ static int getSubsamp(j_decompress_ptr dinfo)
D_MAX_BLOCKS_IN_MCU / pixelsize[i] && i == TJSAMP_444) { D_MAX_BLOCKS_IN_MCU / pixelsize[i] && i == TJSAMP_444) {
int match = 0; int match = 0;
for (k = 1; k < dinfo->num_components; k++) { for (k = 1; k < dinfo->num_components; k++) {
if (dinfo->comp_info[i].h_samp_factor == if (dinfo->comp_info[k].h_samp_factor ==
dinfo->comp_info[0].h_samp_factor && dinfo->comp_info[0].h_samp_factor &&
dinfo->comp_info[i].v_samp_factor == dinfo->comp_info[k].v_samp_factor ==
dinfo->comp_info[0].v_samp_factor) dinfo->comp_info[0].v_samp_factor)
match++; match++;
if (match == dinfo->num_components - 1) { if (match == dinfo->num_components - 1) {