diff --git a/ChangeLog.txt b/ChangeLog.txt index f5374ef7..6f39b0a2 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -98,6 +98,14 @@ and IDCT algorithms (both are used during JPEG decompression.) For unknown reasons (probably related to clang), this code cannot currently be compiled for iOS. +[15] Fixed an extremely rare bug that could cause the Huffman encoder's local +buffer to overrun when a very high-frequency MCU is compressed using quality +100 and no subsampling, and when the JPEG output buffer is being dynamically +resized by the destination manager. This issue was so rare that, even with a +test program specifically designed to make the bug occur (by injecting random +high-frequency YUV data into the compressor), it was reproducible only once in +about every 25 million iterations. + 1.3.1 ===== diff --git a/jchuff.c b/jchuff.c index 026b1f29..d8eb1d35 100644 --- a/jchuff.c +++ b/jchuff.c @@ -408,7 +408,7 @@ dump_buffer (working_state * state) #endif -#define BUFSIZE (DCTSIZE2 * 2) +#define BUFSIZE (DCTSIZE2 * 2) + 8 #define LOAD_BUFFER() { \ if (state->free_in_buffer < BUFSIZE) { \ @@ -443,7 +443,7 @@ dump_buffer (working_state * state) LOCAL(boolean) flush_bits (working_state * state) { - JOCTET _buffer[BUFSIZE + 8], *buffer; + JOCTET _buffer[BUFSIZE], *buffer; size_t put_buffer; int put_bits; size_t bytes, bytestocopy; int localbuf = 0; @@ -472,7 +472,7 @@ encode_one_block (working_state * state, JCOEFPTR block, int last_dc_val, int temp, temp2, temp3; int nbits; int r, code, size; - JOCTET _buffer[BUFSIZE + 8], *buffer; + JOCTET _buffer[BUFSIZE], *buffer; size_t put_buffer; int put_bits; int code_0xf0 = actbl->ehufco[0xf0], size_0xf0 = actbl->ehufsi[0xf0]; size_t bytes, bytestocopy; int localbuf = 0;