From: DRC <information@libjpeg-turbo.org>
Date: Tue, 14 Nov 2017 21:30:06 +0000 (-0600)
Subject: tjbench.exe: Fix decompression access violation
X-Git-Tag: 1.5.3~9
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5fce2e942136cb70e5a30ff15a2d58b07947aa84;p=libjpeg-turbo

tjbench.exe: Fix decompression access violation

The program crashed when a JPEG image was passed on the command line,
because we were mixing our metaphors vis-a-vis malloc()/free() and
tjAlloc()/tjFree() (malloc()/free() uses the tjbench.exe heap,
whereas tjAlloc()/tjFree() uses the turbojpeg.dll heap.)
---

diff --git a/ChangeLog.md b/ChangeLog.md
index e6565cd..7aa507e 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -25,6 +25,9 @@ quantization was enabled.
 command-line argument is unrecognized.  This prevents the program from silently
 ignoring typos.
 
+6. Fixed an access violation in tjbench.exe (Windows) that occurred when the
+program was used to decompress an existing JPEG image.
+
 
 1.5.2
 =====
diff --git a/tjbench.c b/tjbench.c
index dfe6601..76b61cd 100644
--- a/tjbench.c
+++ b/tjbench.c
@@ -502,7 +502,7 @@ int decompTest(char *filename)
 	char *temp=NULL, tempstr[80], tempstr2[80];
 	int row, col, i, iter, tilew, tileh, ntilesw=1, ntilesh=1, retval=0;
 	double start, elapsed;
-	int ps=tjPixelSize[pf], tile;
+	int ps=tjPixelSize[pf], tile, decompsrc=0;
 
 	if((file=fopen(filename, "rb"))==NULL)
 		_throwunix("opening file");
@@ -682,18 +682,17 @@ int decompTest(char *filename)
 		else
 		{
 			if(quiet==1) printf("N/A     N/A     ");
-			jpegsize[0]=srcsize;
-			free(jpegbuf[0]);
-			jpegbuf[0]=srcbuf;
-			srcbuf=NULL;
+			tjFree(jpegbuf[0]);
+			jpegbuf[0]=NULL;
+			decompsrc=1;
 		}
 
 		if(w==tilew) _tilew=_w;
 		if(h==tileh) _tileh=_h;
 		if(!(xformopt&TJXOPT_NOOUTPUT))
 		{
-			if(decomp(NULL, jpegbuf, jpegsize, NULL, _w, _h, _subsamp, 0,
-				filename, _tilew, _tileh)==-1)
+			if(decomp(NULL, decompsrc? &srcbuf:jpegbuf, decompsrc? &srcsize:jpegsize,
+					NULL, _w, _h, _subsamp, 0, filename, _tilew, _tileh)==-1)
 				goto bailout;
 		}
 		else if(quiet==1) printf("N/A\n");