coffee/libyuv
1
0
Fork 0
mirror of https://chromium.googlesource.com/libyuv/libyuv synced 2026-10-28 18:07:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Document why MJPEG databuf size cannot overflow

Browse Source 
Change-Id: I584afd17cbb1ecef5d70a9531b7a6cfb2c0441e3
Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/8075298
Reviewed-by: Wan-Teh Chang <wtc@google.com>
Reviewed-by: Frank Barchard <fbarchard@google.com>
This commit is contained in:
Maximilian Hils 2026-07-22 10:38:34 +00:00 committed by Frank Barchard
parent a86d27122a
commit 240ac24a88
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source/mjpeg_decoder.cc
View File

@ -140,6 +140,10 @@ LIBYUV_BOOL MJpegDecoder::LoadFrame(const uint8_t* src, size_t src_len) {
// the next scanline) and will be overwritten when jpeglib writes out that // the next scanline) and will be overwritten when jpeglib writes out that
// next scanline. // next scanline.
int databuf_stride = GetComponentStride(i); int databuf_stride = GetComponentStride(i);
// Cannot overflow:
// - JPEG width is stored as an u16, so `databuf_stride` (width rounded up to
// DCTSIZE) is at most slightly larger than UINT16_MAX.
// - Sampling factor is stored in 4 bits, so scanlines_size is < 16.
int databuf_size = scanlines_size * databuf_stride; int databuf_size = scanlines_size * databuf_stride;
if (databuf_strides_[i] != databuf_stride) { if (databuf_strides_[i] != databuf_stride) {
if (databuf_[i]) { if (databuf_[i]) {