libjpeg-turbo/files/libjpeg-turbo-1.2.0-guard_against_bad_num_components_value.patch

Wed May 30 20:36:42 2012 UTC by dcommander with message:

"Guard against num_components being a ridiculous value due to a corrupt header"

http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo/branches/1.2.x/jdmarker.c?r1=751&r2=831&pathrev=831

--- jdmarker.c
+++ jdmarker.c
@@ -323,14 +323,15 @@
 
   /* Collect the component-spec parameters */
 
-  for (i = 0; i < cinfo->num_components; i++)
+  for (i = 0; i < MAX_COMPS_IN_SCAN; i++)
     cinfo->cur_comp_info[i] = NULL;
 
   for (i = 0; i < n; i++) {
     INPUT_BYTE(cinfo, cc, return FALSE);
     INPUT_BYTE(cinfo, c, return FALSE);
     
-    for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
+    for (ci = 0, compptr = cinfo->comp_info;
+        ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN;
         ci++, compptr++) {
       if (cc == compptr->component_id && !cinfo->cur_comp_info[ci])
        goto id_found;
1	Wed May 30 20:36:42 2012 UTC by dcommander with message:
2
3	"Guard against num_components being a ridiculous value due to a corrupt header"
4
5	http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo/branches/1.2.x/jdmarker.c?r1=751&r2=831&pathrev=831
6
7	--- jdmarker.c
8	+++ jdmarker.c
9	@@ -323,14 +323,15 @@
10
11	/* Collect the component-spec parameters */
12
13	- for (i = 0; i < cinfo->num_components; i++)
14	+ for (i = 0; i < MAX_COMPS_IN_SCAN; i++)
15	cinfo->cur_comp_info[i] = NULL;
16
17	for (i = 0; i < n; i++) {
18	INPUT_BYTE(cinfo, cc, return FALSE);
19	INPUT_BYTE(cinfo, c, return FALSE);
20
21	- for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
22	+ for (ci = 0, compptr = cinfo->comp_info;
23	+ ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN;
24	ci++, compptr++) {
25	if (cc == compptr->component_id && !cinfo->cur_comp_info[ci])
26	goto id_found;