coffee/libyuv
1
0
Fork 0
mirror of https://chromium.googlesource.com/libyuv/libyuv synced 2026-07-30 16:26:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

Document why MJPEG databuf size cannot overflow

Browse Source 
Change-Id: I584afd17cbb1ecef5d70a9531b7a6cfb2c0441e3
This commit is contained in:
Maximilian Hils 2026-07-22 10:27:06 +00:00
parent b56492e2df
commit 9f805c9f10
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source/mjpeg_decoder.cc
View File

@ -140,6 +140,10 @@ LIBYUV_BOOL MJpegDecoder::LoadFrame(const uint8_t* src, size_t src_len) {
// the next scanline) and will be overwritten when jpeglib writes out that
// next scanline.
int databuf_stride = GetComponentStride(i);
// Cannot overflow:
// - JPEG width is stored as an u16, so `databuf_stride` (width rounded up to
// DCTSIZE) is at most slightly larger than UINT16_MAX.
// - Sampling factor is stored in 4 bits, so scanlines_size is < 16.
int databuf_size = scanlines_size * databuf_stride;
if (databuf_strides_[i] != databuf_stride) {
if (databuf_[i]) {