You've already forked libjpeg-turbo
mirror of
https://github.com/libjpeg-turbo/libjpeg-turbo.git
synced 2026-10-23 11:48:53 +03:00
2fa570c514
- Track destination buffer sizes separately for each transformed image
in tj3Transform(). Since all transform operations are processed
serially, the previous behavior made it impossible to reuse a
destination buffer across multiple tj3Transform() calls if multiple
simultaneous transform operations were performed. This did not, as
far as I can tell, create any issues other than unnecessary buffer
reallocations.
- Disallow duplicate destination buffers for multiple simultaneous
transform operations in tj3Transform(). This prevents a UAF issue
whereby, if the destination buffer was insufficiently large, it was
reallocated during the first transform operation and became invalid
for subsequent operations.
- Streamline the JPEG destination buffer management documentation, and
document the actual tj3Transform() buffer reuse behavior. Clarify
that a JPEG destination buffer is API-managed rather than
caller-managed throughout the scope of its use in compression and
transform function calls.
- Test all of the above in tjunittest. (The new test also validates the
fixes described in b1c3f8256e and
1f3614f167d8658a9df88dfe351ef5e751fc0461.)