media/libjpeg/1050342.diff

   1 Bug 1050342. Fix a case where the fast huffman decoder in libjpeg-turbo can produce different results depending on how data is fed to it.
   2
   3 This change comes from the blink repo https://codereview.appspot.com/229430043/ and is unlikely to be accepted upstream into libjpeg-turbo.
   4
   5 diff --git jdhuff.c jdhuff.c
   6 --- jdhuff.c
   7 +++ jdhuff.c
   8 @@ -674,9 +674,9 @@ decode_mcu_fast(j_decompress_ptr cinfo,
   9      d_derived_tbl *dctbl = entropy->dc_cur_tbls[blkn];
  10      d_derived_tbl *actbl = entropy->ac_cur_tbls[blkn];
  11      register int s, k, r, l;
  12
  13 -    HUFF_DECODE_FAST(s, l, dctbl);
  14 +    HUFF_DECODE_FAST(s, l, dctbl, slow_decode_mcu);
  15      if (s) {
  16        FILL_BIT_BUFFER_FAST
  17        r = GET_BITS(s);
  18        s = HUFF_EXTEND(r, s);
  19 @@ -692,9 +692,9 @@ decode_mcu_fast(j_decompress_ptr cinfo,
  20
  21      if (entropy->ac_needed[blkn] && block) {
  22
  23        for (k = 1; k < DCTSIZE2; k++) {
  24 -        HUFF_DECODE_FAST(s, l, actbl);
  25 +        HUFF_DECODE_FAST(s, l, actbl, slow_decode_mcu);
  26          r = s >> 4;
  27          s &= 15;
  28
  29          if (s) {
  30 @@ -711,9 +711,9 @@ decode_mcu_fast(j_decompress_ptr cinfo,
  31
  32      } else {
  33
  34        for (k = 1; k < DCTSIZE2; k++) {
  35 -        HUFF_DECODE_FAST(s, l, actbl);
  36 +        HUFF_DECODE_FAST(s, l, actbl, slow_decode_mcu);
  37          r = s >> 4;
  38          s &= 15;
  39
  40          if (s) {
  41 @@ -728,8 +728,9 @@ decode_mcu_fast(j_decompress_ptr cinfo,
  42      }
  43    }
  44
  45    if (cinfo->unread_marker != 0) {
  46 +slow_decode_mcu:
  47      cinfo->unread_marker = 0;
  48      return FALSE;
  49    }
  50
  51 diff --git jdhuff.h jdhuff.h
  52 --- jdhuff.h
  53 +++ jdhuff.h
  54 @@ -210,9 +210,9 @@ slowlabel: \
  55      get_buffer = state.get_buffer;  bits_left = state.bits_left; \
  56    } \
  57  }
  58
  59 -#define HUFF_DECODE_FAST(s, nb, htbl) \
  60 +#define HUFF_DECODE_FAST(s, nb, htbl, slowlabel) \
  61    FILL_BIT_BUFFER_FAST; \
  62    s = PEEK_BITS(HUFF_LOOKAHEAD); \
  63    s = htbl->lookup[s]; \
  64    nb = s >> HUFF_LOOKAHEAD; \
  65 @@ -227,9 +227,11 @@ slowlabel: \
  66        s <<= 1; \
  67        s |= GET_BITS(1); \
  68        nb++; \
  69      } \
  70 -    s = htbl->pub->huffval[(int)(s + htbl->valoffset[nb]) & 0xFF]; \
  71 +    if (nb > 16) \
  72 +      goto slowlabel; \
  73 +    s = htbl->pub->huffval[ (int) (s + htbl->valoffset[nb]) ]; \
  74    }
  75
  76  /* Out-of-line case for Huffman code fetching */
  77  EXTERN(int) jpeg_huff_decode(bitread_working_state *state,