ryan/mozjpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Actually, we need to increase the size of BUFSIZE, not just the size of _buffer. The previous patch might have cause problems if, for instance, state->free_in_buffer was 127 but 129 bytes were compressed. In that case, only 127 of the 129 bytes would have been written to the file. Also document the fix.

Browse Source 
git-svn-id: svn+ssh://svn.code.sf.net/p/libjpeg-turbo/code/trunk@1367 632fc199-4ca6-4c93-a231-07263d6284db
This commit is contained in:
DRC
2014-08-21 03:40:37 +00:00
parent 4d117e06bc 0e5f88dbe1
commit f63d1609dc
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ChangeLog.txt
View File

@@ -98,6 +98,14 @@ and IDCT algorithms (both are used during JPEG decompression.) For unknown
reasons (probably related to clang), this code cannot currently be compiled for reasons (probably related to clang), this code cannot currently be compiled for
iOS. iOS.
[15] Fixed an extremely rare bug that could cause the Huffman encoder's local
buffer to overrun when a very high-frequency MCU is compressed using quality
100 and no subsampling, and when the JPEG output buffer is being dynamically
resized by the destination manager. This issue was so rare that, even with a
test program specifically designed to make the bug occur (by injecting random
high-frequency YUV data into the compressor), it was reproducible only once in
about every 25 million iterations.
1.3.1 1.3.1
===== =====

6
jchuff.c
View File

@@ -408,7 +408,7 @@ dump_buffer (working_state * state)
#endif #endif
#define BUFSIZE (DCTSIZE2 * 2) #define BUFSIZE (DCTSIZE2 * 2) + 8
#define LOAD_BUFFER() { \ #define LOAD_BUFFER() { \
if (state->free_in_buffer < BUFSIZE) { \ if (state->free_in_buffer < BUFSIZE) { \
@@ -443,7 +443,7 @@ dump_buffer (working_state * state)
LOCAL(boolean) LOCAL(boolean)
flush_bits (working_state * state) flush_bits (working_state * state)
{ {
JOCTET _buffer[BUFSIZE + 8], *buffer; JOCTET _buffer[BUFSIZE], *buffer;
size_t put_buffer; int put_bits; size_t put_buffer; int put_bits;
size_t bytes, bytestocopy; int localbuf = 0; size_t bytes, bytestocopy; int localbuf = 0;
@@ -472,7 +472,7 @@ encode_one_block (working_state * state, JCOEFPTR block, int last_dc_val,
int temp, temp2, temp3; int temp, temp2, temp3;
int nbits; int nbits;
int r, code, size; int r, code, size;
JOCTET _buffer[BUFSIZE + 8], *buffer; JOCTET _buffer[BUFSIZE], *buffer;
size_t put_buffer; int put_bits; size_t put_buffer; int put_bits;
int code_0xf0 = actbl->ehufco[0xf0], size_0xf0 = actbl->ehufsi[0xf0]; int code_0xf0 = actbl->ehufco[0xf0], size_0xf0 = actbl->ehufsi[0xf0];
size_t bytes, bytestocopy; int localbuf = 0; size_t bytes, bytestocopy; int localbuf = 0;