print_message(info, "output_message");
}
+static void progress_monitor(j_common_ptr info) {
+ int scan = ((j_decompress_ptr)info)->input_scan_number;
+ // Progressive images with a very large number of scans can cause the
+ // decoder to hang. Here we use the progress monitor to abort on
+ // a very large number of scans. 100 is arbitrary, but much larger
+ // than the number of scans we might expect in a normal image.
+ if (scan >= 100) {
+ skjpeg_err_exit(info);
+ }
+}
+
bool JpegDecoderMgr::returnFalse(const char caller[]) {
print_message((j_common_ptr) &fDInfo, caller);
return false;
fInit = true;
fDInfo.src = &fSrcMgr;
fDInfo.err->output_message = &output_message;
+ fDInfo.progress = &fProgressMgr;
+ fProgressMgr.progress_monitor = &progress_monitor;
}
JpegDecoderMgr::~JpegDecoderMgr() {
jpeg_decompress_struct fDInfo;
skjpeg_source_mgr fSrcMgr;
skjpeg_error_mgr fErrorMgr;
+ jpeg_progress_mgr fProgressMgr;
bool fInit;
};
// ASAN will complain if there is an issue.
test_invalid_images(r, "invalid_images/int_overflow.ico", false);
test_invalid_images(r, "invalid_images/skbug5887.gif", true);
+ test_invalid_images(r, "invalid_images/many-progressive-scans.jpg", false);
}