lib/libjpeg-turbo
1
0
Fork 0
mirror of https://github.com/libjpeg-turbo/libjpeg-turbo.git synced 2026-10-24 23:39:22 +03:00
Code Activity

Fix FPE w/tj3LoadImage*/index clr PNG/TJPF_UNKNOWN

Browse Source 
Due to an oversight in 285744829a, the PNG
reader did not handle cinfo->in_color_space == JCS_UNKNOWN (which only
occurs if *pixelFormat = TJPF_UNKNOWN is passed to tj3LoadImage*()) for
non-grayscale indexed-color PNG images.  If the image's palette
contained non-grayscale colors, then cinfo->in_color_space remained
JCS_UNKNOWN, which caused cinfo->input_components to be 0, which caused
samplesperrow = 0 to be passed to the memory manager's alloc_sarray
method when attempting to allocate the intermediate buffer for pixel
format translation.  In the alloc_sarray() method, an integer
division-by-zero error occurred when computing ltemp.  On x86 platforms,
this caused SIGFPE to be thrown.  On AArch64 platforms, ltemp was
computed to be 0, which caused rowsperchunk to be 0, which caused an
infinite loop because currow was never incremented.

This commit modifies the PNG reader accordingly and also hardens the
memory manager against such erroneous arguments.

Fixes #911
This commit is contained in:
DRC
2026-08-15 13:49:19 -04:00
parent b9132f0ad0
commit f14656395b
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog.md
View File

@@ -30,6 +30,10 @@ implementation.
attempting to use `tj3LoadImage12()` or `tj3LoadImage16()` from a 32-bit build
of libjpeg-turbo to load a packed-pixel image with more than 2^31 components.
5. Fixed a division-by-zero error that occurred when attempting to load a
non-grayscale indexed-color PNG image using `tj3LoadImage*()` if the pixel
format of the packed-pixel buffer was unspecified (`TJPF_UNKNOWN`.)
3.2.0
=====

6
src/jmemmgr.c
View File

@@ -4,7 +4,7 @@
* This file was part of the Independent JPEG Group's software:
* Copyright (C) 1991-1997, Thomas G. Lane.
* libjpeg-turbo Modifications:
* Copyright (C) 2016, 2021-2022, 2024, D. R. Commander.
* Copyright (C) 2016, 2021-2022, 2024, 2026, D. R. Commander.
* For conditions of distribution and use, see the accompanying README.ijg
* file.
*
@@ -459,7 +459,7 @@ alloc_sarray(j_common_ptr cinfo, int pool_id, JDIMENSION samplesperrow,
if ((ALIGN_SIZE % sample_size) != 0)
out_of_memory(cinfo, 5); /* safety check */
if (samplesperrow > MAX_ALLOC_CHUNK) {
if (samplesperrow == 0 || samplesperrow > MAX_ALLOC_CHUNK) {
/* This prevents overflow/wrap-around in round_up_pow2() if sizeofobject
is close to SIZE_MAX. */
out_of_memory(cinfo, 9);
@@ -560,7 +560,7 @@ alloc_barray(j_common_ptr cinfo, int pool_id, JDIMENSION blocksperrow,
long ltemp;
/* Make sure each row is properly aligned */
if ((sizeof(JBLOCK) % ALIGN_SIZE) != 0)
if (blocksperrow == 0 || (sizeof(JBLOCK) % ALIGN_SIZE) != 0)
out_of_memory(cinfo, 6); /* safety check */
/* Calculate max # of rows allowed in one allocation chunk */

2
src/rdpng.c
View File

@@ -590,6 +590,8 @@ start_input_png(j_compress_ptr cinfo, cjpeg_source_ptr sinfo)
if ((cinfo->in_color_space == JCS_UNKNOWN ||
cinfo->in_color_space == JCS_RGB) && gray)
cinfo->in_color_space = JCS_GRAYSCALE;
else if (cinfo->in_color_space == JCS_UNKNOWN)
cinfo->in_color_space = JCS_EXT_RGB;
if (cinfo->in_color_space == JCS_GRAYSCALE && !gray)
ERREXIT(cinfo, JERR_BAD_IN_COLORSPACE);