Bug 891693 - Ban SOS with repeated components IDs. r=jmuizelaar, r=DRC, a=bajaj
authorMilan Sreckovic <milan@mozilla.com>
Thu, 05 Sep 2013 17:27:35 -0700
changeset 119964 c699a8e7bde911125c271e9fdcb5d35990772b83
parent 119963 a9fa9a04390d5ad789c56320860148f2be940116
child 119965 617eb9d9bcc23f80ed8059474c37ed412617cb18
push id1100
push userryanvm@gmail.com
push dateThu, 21 Nov 2013 13:35:39 +0000
reviewersjmuizelaar, DRC, bajaj
bugs891693
milestone18.1
Bug 891693 - Ban SOS with repeated components IDs. r=jmuizelaar, r=DRC, a=bajaj
media/libjpeg/jdmarker.c
--- a/media/libjpeg/jdmarker.c
+++ b/media/libjpeg/jdmarker.c
@@ -298,17 +298,17 @@ get_sof (j_decompress_ptr cinfo, boolean
 }
 
 
 LOCAL(boolean)
 get_sos (j_decompress_ptr cinfo)
 /* Process a SOS marker */
 {
   INT32 length;
-  int i, ci, n, c, cc;
+  int i, ci, n, c, cc, pi;
   jpeg_component_info * compptr;
   INPUT_VARS(cinfo);
 
   if (! cinfo->marker->saw_SOF)
     ERREXIT(cinfo, JERR_SOS_NO_SOF);
 
   INPUT_2BYTES(cinfo, length, return FALSE);
 
@@ -342,16 +342,23 @@ get_sos (j_decompress_ptr cinfo)
   id_found:
 
     cinfo->cur_comp_info[i] = compptr;
     compptr->dc_tbl_no = (c >> 4) & 15;
     compptr->ac_tbl_no = (c     ) & 15;
     
     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
+
+    /* This CSi (cc) should differ from the previous CSi */
+    for (pi = 0; pi < i; pi++) {
+      if (cinfo->cur_comp_info[pi] == compptr) {
+        ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
+      }
+    }
   }
 
   /* Collect the additional scan parameters Ss, Se, Ah/Al. */
   INPUT_BYTE(cinfo, c, return FALSE);
   cinfo->Ss = c;
   INPUT_BYTE(cinfo, c, return FALSE);
   cinfo->Se = c;
   INPUT_BYTE(cinfo, c, return FALSE);