0fc7313e54
If the calling application invokes jpeg_save_markers() to save a particular type of marker, then the save_marker() function will be invoked for every marker of that type that is encountered. Previously, only the head of the marker linked list was stored (in jpeg_decompress_struct), so save_marker() had to traverse the entire linked list before it could add a new marker to the tail of the list. That caused CPU usage to grow exponentially with the number of markers. Referring to #764, it is possible to create a JPEG image that contains an excessive number of markers. The specific reproducer that uncovered this issue is a specially-crafted 1-megabyte malformed JPEG image with tens of thousands of APP1 markers, which required approximately 30 seconds of CPU time (on a modern Intel processor) to process. However, it should also be possible to create a legitimate JPEG image that reproduces the issue (such as an image with tens of thousands of duplicate EXIF tags.) This commit introduces a new pointer (in jpeg_decomp_master, in order to preserve backward ABI compatibility) that is used to store the tail of the marker linked list whenever a marker is added to it. Thus, it is no longer necessary to traverse the list when adding a marker, and CPU usage will grow linearly rather than exponentially with the number of markers. Fixes #764
111 lines
3.2 KiB
C
111 lines
3.2 KiB
C
/*
|
|
* jcomapi.c
|
|
*
|
|
* This file was part of the Independent JPEG Group's software:
|
|
* Copyright (C) 1994-1997, Thomas G. Lane.
|
|
* libjpeg-turbo Modifications:
|
|
* Copyright (C) 2024, D. R. Commander.
|
|
* For conditions of distribution and use, see the accompanying README.ijg
|
|
* file.
|
|
*
|
|
* This file contains application interface routines that are used for both
|
|
* compression and decompression.
|
|
*/
|
|
|
|
#define JPEG_INTERNALS
|
|
#include "jinclude.h"
|
|
#include "jpeglib.h"
|
|
|
|
|
|
/*
|
|
* Abort processing of a JPEG compression or decompression operation,
|
|
* but don't destroy the object itself.
|
|
*
|
|
* For this, we merely clean up all the nonpermanent memory pools.
|
|
* Note that temp files (virtual arrays) are not allowed to belong to
|
|
* the permanent pool, so we will be able to close all temp files here.
|
|
* Closing a data source or destination, if necessary, is the application's
|
|
* responsibility.
|
|
*/
|
|
|
|
GLOBAL(void)
|
|
jpeg_abort(j_common_ptr cinfo)
|
|
{
|
|
int pool;
|
|
|
|
/* Do nothing if called on a not-initialized or destroyed JPEG object. */
|
|
if (cinfo->mem == NULL)
|
|
return;
|
|
|
|
/* Releasing pools in reverse order might help avoid fragmentation
|
|
* with some (brain-damaged) malloc libraries.
|
|
*/
|
|
for (pool = JPOOL_NUMPOOLS - 1; pool > JPOOL_PERMANENT; pool--) {
|
|
(*cinfo->mem->free_pool) (cinfo, pool);
|
|
}
|
|
|
|
/* Reset overall state for possible reuse of object */
|
|
if (cinfo->is_decompressor) {
|
|
cinfo->global_state = DSTATE_START;
|
|
/* Try to keep application from accessing now-deleted marker list.
|
|
* A bit kludgy to do it here, but this is the most central place.
|
|
*/
|
|
((j_decompress_ptr)cinfo)->marker_list = NULL;
|
|
((j_decompress_ptr)cinfo)->master->marker_list_end = NULL;
|
|
} else {
|
|
cinfo->global_state = CSTATE_START;
|
|
}
|
|
}
|
|
|
|
|
|
/*
|
|
* Destruction of a JPEG object.
|
|
*
|
|
* Everything gets deallocated except the master jpeg_compress_struct itself
|
|
* and the error manager struct. Both of these are supplied by the application
|
|
* and must be freed, if necessary, by the application. (Often they are on
|
|
* the stack and so don't need to be freed anyway.)
|
|
* Closing a data source or destination, if necessary, is the application's
|
|
* responsibility.
|
|
*/
|
|
|
|
GLOBAL(void)
|
|
jpeg_destroy(j_common_ptr cinfo)
|
|
{
|
|
/* We need only tell the memory manager to release everything. */
|
|
/* NB: mem pointer is NULL if memory mgr failed to initialize. */
|
|
if (cinfo->mem != NULL)
|
|
(*cinfo->mem->self_destruct) (cinfo);
|
|
cinfo->mem = NULL; /* be safe if jpeg_destroy is called twice */
|
|
cinfo->global_state = 0; /* mark it destroyed */
|
|
}
|
|
|
|
|
|
/*
|
|
* Convenience routines for allocating quantization and Huffman tables.
|
|
* (Would jutils.c be a more reasonable place to put these?)
|
|
*/
|
|
|
|
GLOBAL(JQUANT_TBL *)
|
|
jpeg_alloc_quant_table(j_common_ptr cinfo)
|
|
{
|
|
JQUANT_TBL *tbl;
|
|
|
|
tbl = (JQUANT_TBL *)
|
|
(*cinfo->mem->alloc_small) (cinfo, JPOOL_PERMANENT, sizeof(JQUANT_TBL));
|
|
tbl->sent_table = FALSE; /* make sure this is false in any new table */
|
|
return tbl;
|
|
}
|
|
|
|
|
|
GLOBAL(JHUFF_TBL *)
|
|
jpeg_alloc_huff_table(j_common_ptr cinfo)
|
|
{
|
|
JHUFF_TBL *tbl;
|
|
|
|
tbl = (JHUFF_TBL *)
|
|
(*cinfo->mem->alloc_small) (cinfo, JPOOL_PERMANENT, sizeof(JHUFF_TBL));
|
|
tbl->sent_table = FALSE; /* make sure this is false in any new table */
|
|
return tbl;
|
|
}
|