more jpeg read sanity checking

This commit is contained in:
John Cupitt 2014-01-23 14:19:55 +00:00
parent 2f9cc275e6
commit 12454d3225

View File

@ -150,6 +150,10 @@ typedef struct _ReadJpeg {
/* Set if we need to finish the decompress. /* Set if we need to finish the decompress.
*/ */
gboolean decompressing; gboolean decompressing;
/* Track the y pos during a read with this.
*/
int y_pos;
} ReadJpeg; } ReadJpeg;
static int static int
@ -222,6 +226,8 @@ readjpeg_new( VipsImage *out, int shrink, gboolean fail, gboolean readbehind )
jpeg->eman.pub.output_message = vips__new_output_message; jpeg->eman.pub.output_message = vips__new_output_message;
jpeg->eman.fp = NULL; jpeg->eman.fp = NULL;
jpeg->y_pos = 0;
/* jpeg_create_decompress() can fail on some sanity checks. Don't /* jpeg_create_decompress() can fail on some sanity checks. Don't
* readjpeg_free() since we don't want to jpeg_destroy_decompress(). * readjpeg_free() since we don't want to jpeg_destroy_decompress().
*/ */
@ -907,6 +913,11 @@ read_jpeg_generate( VipsRegion *or,
*/ */
g_assert( r->height == VIPS_MIN( 8, or->im->Ysize - r->top ) ); g_assert( r->height == VIPS_MIN( 8, or->im->Ysize - r->top ) );
/* And check that y_pos is correct. It should be, since we are inside
* a vips_sequential().
*/
g_assert( r->top == jpeg->y_pos );
/* Here for longjmp() from vips__new_error_exit(). /* Here for longjmp() from vips__new_error_exit().
*/ */
if( setjmp( jpeg->eman.jmp ) ) if( setjmp( jpeg->eman.jmp ) )
@ -926,6 +937,8 @@ read_jpeg_generate( VipsRegion *or,
for( x = 0; x < sz; x++ ) for( x = 0; x < sz; x++ )
row_pointer[0][x] = 255 - row_pointer[0][x]; row_pointer[0][x] = 255 - row_pointer[0][x];
} }
jpeg->y_pos += 1;
} }
VIPS_GATE_STOP( "read_jpeg_generate: work" ); VIPS_GATE_STOP( "read_jpeg_generate: work" );