Bug 891693 - Ban SOS with repeated components IDs. r=jmuizelaar, r=DRC, a=abillings
authorMilan Sreckovic <milan@mozilla.com>
Thu, 05 Sep 2013 17:27:35 -0700
changeset 166548 d60b630fdd37ae95427843da8093eb898be162cd
parent 166547 599e2ddfb6a9db399cca618ab7b8a79e3173020f
child 166549 a1db4e79b1e2348e64014f8ad4b57f42fbe67f18
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjmuizelaar, DRC, abillings
bugs891693
milestone27.0a2
Bug 891693 - Ban SOS with repeated components IDs. r=jmuizelaar, r=DRC, a=abillings
media/libjpeg/jdmarker.c
--- a/media/libjpeg/jdmarker.c
+++ b/media/libjpeg/jdmarker.c
@@ -299,17 +299,17 @@ get_sof (j_decompress_ptr cinfo, boolean
 }
 
 
 LOCAL(boolean)
 get_sos (j_decompress_ptr cinfo)
 /* Process a SOS marker */
 {
   INT32 length;
-  int i, ci, n, c, cc;
+  int i, ci, n, c, cc, pi;
   jpeg_component_info * compptr;
   INPUT_VARS(cinfo);
 
   if (! cinfo->marker->saw_SOF)
     ERREXIT(cinfo, JERR_SOS_NO_SOF);
 
   INPUT_2BYTES(cinfo, length, return FALSE);
 
@@ -343,16 +343,23 @@ get_sos (j_decompress_ptr cinfo)
   id_found:
 
     cinfo->cur_comp_info[i] = compptr;
     compptr->dc_tbl_no = (c >> 4) & 15;
     compptr->ac_tbl_no = (c     ) & 15;
     
     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
+
+    /* This CSi (cc) should differ from the previous CSi */
+    for (pi = 0; pi < i; pi++) {
+      if (cinfo->cur_comp_info[pi] == compptr) {
+        ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
+      }
+    }
   }
 
   /* Collect the additional scan parameters Ss, Se, Ah/Al. */
   INPUT_BYTE(cinfo, c, return FALSE);
   cinfo->Ss = c;
   INPUT_BYTE(cinfo, c, return FALSE);
   cinfo->Se = c;
   INPUT_BYTE(cinfo, c, return FALSE);