ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' into dev

Browse Source
This commit is contained in:
DRC
2019-11-12 17:07:46 -06:00
parent 713c451f58 bd20344b0a
commit c43a5081ce
3 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ChangeLog.md
View File

@@ -66,6 +66,16 @@ higher-frequency scan. libjpeg-turbo now applies block smoothing parameters to
each iMCU row based on which scan generated the pixels in that row, rather than each iMCU row based on which scan generated the pixels in that row, rather than
always using the block smoothing parameters for the most recent scan. always using the block smoothing parameters for the most recent scan.
8. Fixed a signed integer overflow and subsequent segfault that occurred when
attempting to decompress images with more than 715827882 pixels using the
64-bit C version of TJBench.
9. Fixed out-of-bounds write in `tjDecompressToYUV2()` and
`tjDecompressToYUVPlanes()` (sometimes manifesting as a double free) that
occurred when attempting to decompress grayscale JPEG images that were
compressed with a sampling factor other than 1 (for instance, with
`cjpeg -grayscale -sample 2x2`).
2.0.3 2.0.3
===== =====

4
tjbench.c
View File

@@ -171,7 +171,7 @@ static int decomp(unsigned char *srcBuf, unsigned char **jpegBuf,
} }
/* Set the destination buffer to gray so we know whether the decompressor /* Set the destination buffer to gray so we know whether the decompressor
attempted to write to it */ attempted to write to it */
memset(dstBuf, 127, pitch * scaledh); memset(dstBuf, 127, (size_t)pitch * scaledh);
if (doYUV) { if (doYUV) {
int width = doTile ? tilew : scaledw; int width = doTile ? tilew : scaledw;
@@ -193,7 +193,7 @@ static int decomp(unsigned char *srcBuf, unsigned char **jpegBuf,
double start = getTime(); double start = getTime();
for (row = 0, dstPtr = dstBuf; row < ntilesh; for (row = 0, dstPtr = dstBuf; row < ntilesh;
row++, dstPtr += pitch * tileh) { row++, dstPtr += (size_t)pitch * tileh) {
for (col = 0, dstPtr2 = dstPtr; col < ntilesw; for (col = 0, dstPtr2 = dstPtr; col < ntilesw;
col++, tile++, dstPtr2 += ps * tilew) { col++, tile++, dstPtr2 += ps * tilew) {
int width = doTile ? min(tilew, w - col * tilew) : scaledw; int width = doTile ? min(tilew, w - col * tilew) : scaledw;

6
turbojpeg.c
View File

@@ -1648,10 +1648,8 @@ DLLEXPORT int tjDecompressToYUVPlanes(tjhandle handle,
iw[i] = compptr->width_in_blocks * dctsize; iw[i] = compptr->width_in_blocks * dctsize;
ih = compptr->height_in_blocks * dctsize; ih = compptr->height_in_blocks * dctsize;
pw[i] = PAD(dinfo->output_width, dinfo->max_h_samp_factor) * pw[i] = tjPlaneWidth(i, dinfo->output_width, jpegSubsamp);
compptr->h_samp_factor / dinfo->max_h_samp_factor; ph[i] = tjPlaneHeight(i, dinfo->output_height, jpegSubsamp);
ph[i] = PAD(dinfo->output_height, dinfo->max_v_samp_factor) *
compptr->v_samp_factor / dinfo->max_v_samp_factor;
if (iw[i] != pw[i] || ih != ph[i]) usetmpbuf = 1; if (iw[i] != pw[i] || ih != ph[i]) usetmpbuf = 1;
th[i] = compptr->v_samp_factor * dctsize; th[i] = compptr->v_samp_factor * dctsize;
tmpbufsize += iw[i] * th[i]; tmpbufsize += iw[i] * th[i];