diff options
author | DRC <information@libjpeg-turbo.org> | 2019-09-11 14:22:56 -0700 |
---|---|---|
committer | android-build-merger <android-build-merger@google.com> | 2019-09-11 14:22:56 -0700 |
commit | 7fcb8d19a044ff04e94bfa15ec16d40d4edb6360 (patch) | |
tree | 0e1a0e42ed6995cacbe000a6745c0d38f705d4d4 | |
parent | 8fb8607759444ecbd72321275869a59d921f0161 (diff) | |
parent | 31f2242ed3be70079a2f592b94fa60cbf10c89f8 (diff) | |
download | libjpeg-turbo-7fcb8d19a044ff04e94bfa15ec16d40d4edb6360.tar.gz |
[RESTRICT AUTOMERGE] tjbench.exe: Fix decompression access violation
am: 31f2242ed3
Change-Id: I36e2a39891cb5841f9355076fb32504414b0d57b
-rw-r--r-- | README.android | 7 | ||||
-rw-r--r-- | tjbench.c | 13 |
2 files changed, 13 insertions, 7 deletions
diff --git a/README.android b/README.android index ba6a9ce8..2aa139cf 100644 --- a/README.android +++ b/README.android @@ -46,3 +46,10 @@ This was pulled in due to a SEGFAULT that occurs when running the proof-of-concept for (5) Cherry picked from upstream: https://github.com/libjpeg-turbo/libjpeg-turbo/commit/11eec4a398f3fc1b9d39c1d3b81b53ae85d9b5e6 + +(7) tjbench.c +Fix memory management access violation +This was pulled in due to a SEGFAULT that occurs when running the +proof-of-concept for (5) +Cherry picked from upstream: +https://github.com/libjpeg-turbo/libjpeg-turbo/commit/5fce2e942136cb70e5a30ff15a2d58b07947aa84 @@ -504,7 +504,7 @@ int decompTest(char *filename) char *temp=NULL, tempstr[80], tempstr2[80]; int row, col, i, iter, tilew, tileh, ntilesw=1, ntilesh=1, retval=0; double start, elapsed; - int ps=tjPixelSize[pf], tile; + int ps=tjPixelSize[pf], tile, decompsrc=0; if((file=fopen(filename, "rb"))==NULL) _throwunix("opening file"); @@ -682,18 +682,17 @@ int decompTest(char *filename) else { if(quiet==1) printf("N/A N/A "); - jpegsize[0]=srcsize; - free(jpegbuf[0]); - jpegbuf[0]=srcbuf; - srcbuf=NULL; + tjFree(jpegbuf[0]); + jpegbuf[0]=NULL; + decompsrc=1; } if(w==tilew) _tilew=_w; if(h==tileh) _tileh=_h; if(!(xformopt&TJXOPT_NOOUTPUT)) { - if(decomp(NULL, jpegbuf, jpegsize, NULL, _w, _h, _subsamp, 0, - filename, _tilew, _tileh)==-1) + if(decomp(NULL, decompsrc? &srcbuf:jpegbuf, decompsrc? &srcsize:jpegsize, + NULL, _w, _h, _subsamp, 0, filename, _tilew, _tileh)==-1) goto bailout; } else if(quiet==1) printf("N/A\n"); |