diff options
| author | noel@chromium.org <noel@chromium.org> | 2015-04-27 11:27:28 +0000 |
|---|---|---|
| committer | noel@chromium.org <noel@chromium.org> | 2015-04-27 11:27:28 +0000 |
| commit | 8ee9bdd068effcf5fe876e401829eadb94569750 (patch) | |
| tree | 6851855b0851748d0ffce6f236a0ee1989619560 /jdhuff.h | |
| parent | 9e9058be139a32f2d03eddce97fb15ecca92e6bc (diff) | |
Fix libjpeg_turbo svn r64 libjpeg6b compat issue
Make the fast path Huffman decoder fallback to the slow decoding path if
the Huffman decoding bit sentinel > 16, this to match libjpeg6b decoding
by reproducing the exact behavior of jpeg_huff_decode().
When this sentinel check is missing (see bug), libjpeg_turbo can produce
two (or more) different decoded images for the same input data depending
on how transport systems (eg., networks) packetize the data for delivery
to end-systems, web browsers for example.
Note: libjpeg6b produces the same decoded image, irrespective of how the
input data is placed in network packets. This fix makes libjpeg_turbo do
the same for compat with libjpeg6b.
TBR=darin@chromium.org
BUG=chromium:398235
Review URL: https://codereview.appspot.com/229430043
git-svn-id: http://src.chromium.org/svn/trunk/deps/third_party/libjpeg_turbo@295003 4ff67af0-8c30-449e-8e8b-ad334ec8d88c
Diffstat (limited to 'jdhuff.h')
| -rw-r--r-- | jdhuff.h | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -209,7 +209,7 @@ slowlabel: \ } \ } -#define HUFF_DECODE_FAST(s,nb,htbl) \ +#define HUFF_DECODE_FAST(s,nb,htbl,slowlabel) \ FILL_BIT_BUFFER_FAST; \ s = PEEK_BITS(HUFF_LOOKAHEAD); \ s = htbl->lookup[s]; \ @@ -226,7 +226,9 @@ slowlabel: \ s |= GET_BITS(1); \ nb++; \ } \ - s = htbl->pub->huffval[ (int) (s + htbl->valoffset[nb]) & 0xFF ]; \ + if (nb > 16) \ + goto slowlabel; \ + s = htbl->pub->huffval[ (int) (s + htbl->valoffset[nb]) ]; \ } /* Out-of-line case for Huffman code fetching */ |