From 240ac24a88822e9a2fe54e31a13fcf197ff82d71 Mon Sep 17 00:00:00 2001 From: Maximilian Hils Date: Wed, 22 Jul 2026 10:38:34 +0000 Subject: [PATCH] Document why MJPEG databuf size cannot overflow Change-Id: I584afd17cbb1ecef5d70a9531b7a6cfb2c0441e3 Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/8075298 Reviewed-by: Wan-Teh Chang Reviewed-by: Frank Barchard --- source/mjpeg_decoder.cc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/source/mjpeg_decoder.cc b/source/mjpeg_decoder.cc index ad1762092..559e3e3a7 100644 --- a/source/mjpeg_decoder.cc +++ b/source/mjpeg_decoder.cc @@ -140,6 +140,10 @@ LIBYUV_BOOL MJpegDecoder::LoadFrame(const uint8_t* src, size_t src_len) { // the next scanline) and will be overwritten when jpeglib writes out that // next scanline. int databuf_stride = GetComponentStride(i); + // Cannot overflow: + // - JPEG width is stored as an u16, so `databuf_stride` (width rounded up to + // DCTSIZE) is at most slightly larger than UINT16_MAX. + // - Sampling factor is stored in 4 bits, so scanlines_size is < 16. int databuf_size = scanlines_size * databuf_stride; if (databuf_strides_[i] != databuf_stride) { if (databuf_[i]) {