64-bit tjbench: Fix signed int overflow/segfault
... that occurred when attempting to decompress images with more than 715827882 (2048*1024*1024 / 3) pixels. Fixes #388
This commit is contained in:
@@ -8,6 +8,10 @@
|
||||
64-bit libjpeg-turbo SDK for Visual C++ were installed on the same system, only
|
||||
one of them could be uninstalled.
|
||||
|
||||
2. Fixed a signed integer overflow and subsequent segfault that occurred when
|
||||
attempting to decompress images with more than 715827882 pixels using the
|
||||
64-bit C version of TJBench.
|
||||
|
||||
|
||||
2.0.3
|
||||
=====
|
||||
|
||||
@@ -171,7 +171,7 @@ static int decomp(unsigned char *srcBuf, unsigned char **jpegBuf,
|
||||
}
|
||||
/* Set the destination buffer to gray so we know whether the decompressor
|
||||
attempted to write to it */
|
||||
memset(dstBuf, 127, pitch * scaledh);
|
||||
memset(dstBuf, 127, (size_t)pitch * scaledh);
|
||||
|
||||
if (doYUV) {
|
||||
int width = doTile ? tilew : scaledw;
|
||||
@@ -193,7 +193,7 @@ static int decomp(unsigned char *srcBuf, unsigned char **jpegBuf,
|
||||
double start = getTime();
|
||||
|
||||
for (row = 0, dstPtr = dstBuf; row < ntilesh;
|
||||
row++, dstPtr += pitch * tileh) {
|
||||
row++, dstPtr += (size_t)pitch * tileh) {
|
||||
for (col = 0, dstPtr2 = dstPtr; col < ntilesw;
|
||||
col++, tile++, dstPtr2 += ps * tilew) {
|
||||
int width = doTile ? min(tilew, w - col * tilew) : scaledw;
|
||||
|
||||
Reference in New Issue
Block a user