34 lines
1.5 KiB
Diff
34 lines
1.5 KiB
Diff
From 3de15e0c344d11d4b90f4a47136467053eb2d09a Mon Sep 17 00:00:00 2001
|
|
From: DRC <information@libjpeg-turbo.org>
|
|
Date: Tue, 2 Jun 2020 14:15:37 -0500
|
|
Subject: [PATCH] rdppm.c: Fix buf overrun caused by bad binary PPM
|
|
|
|
This extends the fix in 1e81b0c3ea26f4ea8f56de05367469333de64a9f to
|
|
include binary PPM files with maximum values < 255, thus preventing a
|
|
malformed binary PPM input file with those specifications from
|
|
triggering an overrun of the rescale array and potentially crashing
|
|
cjpeg, TJBench, or any program that uses the tjLoadImage() function.
|
|
|
|
Fixes #433
|
|
diff --git a/rdppm.c b/rdppm.c
|
|
index 87bc33090..a8507b902 100644
|
|
--- a/rdppm.c
|
|
+++ b/rdppm.c
|
|
@@ -5,7 +5,7 @@
|
|
* Copyright (C) 1991-1997, Thomas G. Lane.
|
|
* Modified 2009 by Bill Allombert, Guido Vollbeding.
|
|
* libjpeg-turbo Modifications:
|
|
- * Copyright (C) 2015-2017, D. R. Commander.
|
|
+ * Copyright (C) 2015-2017, 2020, D. R. Commander.
|
|
* For conditions of distribution and use, see the accompanying README.ijg
|
|
* file.
|
|
*
|
|
@@ -720,7 +720,7 @@ start_input_ppm(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
|
|
/* On 16-bit-int machines we have to be careful of maxval = 65535 */
|
|
source->rescale = (JSAMPLE *)
|
|
(*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
|
|
- (size_t)(((long)maxval + 1L) *
|
|
+ (size_t)(((long)MAX(maxval, 255) + 1L) *
|
|
sizeof(JSAMPLE)));
|
|
half_maxval = maxval / 2;
|
|
for (val = 0; val <= (long)maxval; val++) {
|