From 94d80ce434c608b5efcaeb430169ec4241622b80 Mon Sep 17 00:00:00 2001
From: Maximilian Hils <mhils@google.com>
Date: Fri, 17 Jul 2026 16:12:44 +0000
Subject: [PATCH] Document why MJPEG databuf size cannot overflow

Change-Id: I584afd17cbb1ecef5d70a9531b7a6cfb2c0441e3
---
 source/mjpeg_decoder.cc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/source/mjpeg_decoder.cc b/source/mjpeg_decoder.cc
index ad1762092..0b283a90a 100644
--- a/source/mjpeg_decoder.cc
+++ b/source/mjpeg_decoder.cc
@@ -140,6 +140,10 @@ LIBYUV_BOOL MJpegDecoder::LoadFrame(const uint8_t* src, size_t src_len) {
     // the next scanline) and will be overwritten when jpeglib writes out that
     // next scanline.
     int databuf_stride = GetComponentStride(i);
+    // Cannot overflow:
+    //  - JPEG width is stored as an u16, so `databuf_stride` (width rounded up to
+    //    DCTSIZE) is at most slightly larger than UINT16_MAX.
+    //  - Sampling factor is stored in 4 bits, so scanlines_size is <16.
     int databuf_size = scanlines_size * databuf_stride;
     if (databuf_strides_[i] != databuf_stride) {
       if (databuf_[i]) {