Fix infinite loop in partial image decompression

... caused by using certain specific combinations of
jpeg_skip_scanlines() and jpeg_read_scanlines() calls with progressive,
vertically-subsampled JPEG images.

Fixes #237

diff --git a/ChangeLog.md b/ChangeLog.md
index ade31c535c2cd4c0598195b94fac71dd50f48602..f64866ed1437e39c9053b45efe718b59f8344d05 100644 (file)
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -35,6 +35,11 @@ the header specified an image width of 1073741824 pixels, would trigger a
 floating point exception (division by zero) in the `tjLoadImage()` function
 when attempting to load the BMP file into a 4-component image buffer.
 
+5. Fixed an issue whereby certain combinations of calls to
+`jpeg_skip_scanlines()` and `jpeg_read_scanlines()` could trigger an infinite
+loop when decompressing progressive JPEG images that use vertical chroma
+subsampling (for instance, 4:2:0 or 4:4:0.)
+
 
 1.5.90 (2.0 beta1)
 ==================

diff --git a/jdapistd.c b/jdapistd.c
index 0e0642bde33d27e0c3fb2af41d187c245e604440..50c84c3537a803a97c982cbb98aba6ac584955d7 100644 (file)
--- a/jdapistd.c
+++ b/jdapistd.c
@@ -4,7 +4,7 @@
  * This file was part of the Independent JPEG Group's software:
  * Copyright (C) 1994-1996, Thomas G. Lane.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2010, 2015-2017, D. R. Commander.
+ * Copyright (C) 2010, 2015-2018, D. R. Commander.
  * Copyright (C) 2015, Google, Inc.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
@@ -479,7 +479,7 @@ jpeg_skip_scanlines(j_decompress_ptr cinfo, JDIMENSION num_lines)
     if (cinfo->upsample->need_context_rows) {
       cinfo->output_scanline += lines_to_skip;
       cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row;
-      main_ptr->iMCU_row_ctr += lines_after_iMCU_row / lines_per_iMCU_row;
+      main_ptr->iMCU_row_ctr += lines_to_skip / lines_per_iMCU_row;
       /* It is complex to properly move to the middle of a context block, so
        * read the remaining lines instead of skipping them.
        */