607b668ff9
The primary purpose of this is to encourage adoption of libjpeg-turbo in downstream Windows projects that forbid the use of "deprecated" functions. libjpeg-turbo's usage of those functions was not actually unsafe, because: - libjpeg-turbo always checks the return value of fopen() and ensures that a NULL filename can never be passed to it. - libjpeg-turbo always checks the return value of getenv() and never passes a NULL argument to it. - The sprintf() calls in format_message() (jerror.c) could never overflow the destination string buffer or leave it unterminated as long as the buffer was at least JMSG_LENGTH_MAX bytes in length, as instructed. (Regardless, this commit replaces those calls with snprintf() calls.) - libjpeg-turbo never uses sscanf() to read strings or multi-byte character arrays. - Because ofb7d6e84d6a, wrjpgcom explicitly checks the bounds of the source and destination strings before calling strcat() and strcpy(). - libjpeg-turbo always ensures that the destination string is terminated when using strncpy(). (548490fe5emade this explicit.) Regarding thread safety: Technically speaking, getenv() is not thread-safe, because the returned pointer may be invalidated if another thread sets the same environment variable between the time that the first thread calls getenv() and the time that that thread uses the return value. In practice, however, this could only occur with libjpeg-turbo if: (1) A multithreaded calling application used the deprecated and undocumented TJFLAG_FORCEMMX/TJFLAG_FORCESSE/TJFLAG_FORCESSE2 flags in the TurboJPEG API or set one of the corresponding environment variables (which are only intended for testing purposes.) Since the TurboJPEG API library only ever passed string constants to putenv(), the only inherent risk (i.e. the only risk introduced by the library and not the calling application) was that the SIMD extensions may have read an incorrect value from one of the aforementioned environment variables. or (2) A multithreaded calling application modified the value of the JPEGMEM environment variable in one thread while another thread was reading the value of that environment variable (in the body of jpeg_create_compress() or jpeg_create_decompress().) Given that the libjpeg API provides a thread-safe way for applications to modify the default memory limit without using the JPEGMEM environment variable, direct modification of that environment variable by calling applications is not supported. Microsoft's implementation of getenv_s() does not claim to be thread-safe either, so this commit uses getenv_s() solely to mollify Visual Studio. New inline functions and macros (GETENV_S() and PUTENV_S) wrap getenv_s()/_putenv_s() when building for Visual Studio and getenv()/setenv() otherwise, but GETENV_S()/PUTENV_S() provide no advantages over getenv()/setenv() other than parameter validation. They are implemented solely for convenience. Technically speaking, strerror() is not thread-safe, because the returned pointer may be invalidated if another thread changes the locale and/or calls strerror() between the time that the first thread calls strerror() and the time that that thread uses the return value. In practice, however, this could only occur with libjpeg-turbo if a multithreaded calling application encountered a file I/O error in tjLoadImage() or tjSaveImage(). Since both of those functions immediately copy the string returned from strerror() into a thread-local buffer, the risk is minimal, and the worst case would involve an incorrect error string being reported to the calling application. Regardless, this commit uses strerror_s() in the TurboJPEG API library when building for Visual Studio. Note that strerror_r() could have been used on Un*x systems, but it would have been necessary to handle both the POSIX and GNU implementations of that function and perform widespread compatibility testing. Such is left as an exercise for another day. Fixes #568
134 lines
2.9 KiB
C
134 lines
2.9 KiB
C
/*
|
|
* jinclude.h
|
|
*
|
|
* This file was part of the Independent JPEG Group's software:
|
|
* Copyright (C) 1991-1994, Thomas G. Lane.
|
|
* libjpeg-turbo Modifications:
|
|
* Copyright (C) 2022, D. R. Commander.
|
|
* For conditions of distribution and use, see the accompanying README.ijg
|
|
* file.
|
|
*
|
|
* This file exists to provide a single place to fix any problems with
|
|
* including the wrong system include files. (Common problems are taken
|
|
* care of by the standard jconfig symbols, but on really weird systems
|
|
* you may have to edit this file.)
|
|
*
|
|
* NOTE: this file is NOT intended to be included by applications using the
|
|
* JPEG library. Most applications need only include jpeglib.h.
|
|
*/
|
|
|
|
#ifndef __JINCLUDE_H__
|
|
#define __JINCLUDE_H__
|
|
|
|
/* Include auto-config file to find out which system include files we need. */
|
|
|
|
#include "jconfig.h" /* auto configuration options */
|
|
#include "jconfigint.h"
|
|
#define JCONFIG_INCLUDED /* so that jpeglib.h doesn't do it again */
|
|
|
|
/*
|
|
* Note that the core JPEG library does not require <stdio.h>;
|
|
* only the default error handler and data source/destination modules do.
|
|
* But we must pull it in because of the references to FILE in jpeglib.h.
|
|
* You can remove those references if you want to compile without <stdio.h>.
|
|
*/
|
|
|
|
#include <stddef.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
/*
|
|
* These macros/inline functions facilitate using Microsoft's "safe string"
|
|
* functions with Visual Studio builds without the need to scatter #ifdefs
|
|
* throughout the code base.
|
|
*/
|
|
|
|
|
|
#ifndef NO_GETENV
|
|
|
|
#ifdef _MSC_VER
|
|
|
|
static INLINE int GETENV_S(char *buffer, size_t buffer_size, const char *name)
|
|
{
|
|
size_t required_size;
|
|
|
|
return (int)getenv_s(&required_size, buffer, buffer_size, name);
|
|
}
|
|
|
|
#else /* _MSC_VER */
|
|
|
|
#include <errno.h>
|
|
|
|
/* This provides a similar interface to the Microsoft/C11 getenv_s() function,
|
|
* but other than parameter validation, it has no advantages over getenv().
|
|
*/
|
|
|
|
static INLINE int GETENV_S(char *buffer, size_t buffer_size, const char *name)
|
|
{
|
|
char *env;
|
|
|
|
if (!buffer) {
|
|
if (buffer_size == 0)
|
|
return 0;
|
|
else
|
|
return (errno = EINVAL);
|
|
}
|
|
if (buffer_size == 0)
|
|
return (errno = EINVAL);
|
|
if (!name) {
|
|
*buffer = 0;
|
|
return 0;
|
|
}
|
|
|
|
env = getenv(name);
|
|
if (!env)
|
|
{
|
|
*buffer = 0;
|
|
return 0;
|
|
}
|
|
|
|
if (strlen(env) + 1 > buffer_size) {
|
|
*buffer = 0;
|
|
return ERANGE;
|
|
}
|
|
|
|
strncpy(buffer, env, buffer_size);
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* _MSC_VER */
|
|
|
|
#endif /* NO_GETENV */
|
|
|
|
|
|
#ifndef NO_PUTENV
|
|
|
|
#ifdef _WIN32
|
|
|
|
#define PUTENV_S(name, value) _putenv_s(name, value)
|
|
|
|
#else
|
|
|
|
/* This provides a similar interface to the Microsoft _putenv_s() function, but
|
|
* other than parameter validation, it has no advantages over setenv().
|
|
*/
|
|
|
|
static INLINE int PUTENV_S(const char *name, const char *value)
|
|
{
|
|
if (!name || !value)
|
|
return (errno = EINVAL);
|
|
|
|
setenv(name, value, 1);
|
|
|
|
return errno;
|
|
}
|
|
|
|
#endif /* _WIN32 */
|
|
|
|
#endif /* NO_PUTENV */
|
|
|
|
|
|
#endif /* JINCLUDE_H */
|