From: DRC <information@libjpeg-turbo.org>
Date: Fri, 12 Apr 2019 14:07:35 +0000 (-0500)
Subject: jdhuff.c: Silence UBSan signed int overflow err #2
X-Git-Tag: 2.0.3~19
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7bc9fca4309563d66b0c5665a616285d0e9baeb4;p=libjpeg-turbo

jdhuff.c: Silence UBSan signed int overflow err #2

Same as d3a3a73f64041c6a6905faf6f9f9832e735fd880 but in the fast decode
path.  It was necessary to use a different-sized test image in order to
trigger the error in this location.

Refer to #347
---

diff --git a/jdhuff.c b/jdhuff.c
index 334ba63..a112817 100644
--- a/jdhuff.c
+++ b/jdhuff.c
@@ -688,7 +688,7 @@ decode_mcu_fast(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
 
     if (entropy->dc_needed[blkn]) {
       int ci = cinfo->MCU_membership[blkn];
-      s += state.last_dc_val[ci];
+      s = (int)((unsigned int)s + (unsigned int)state.last_dc_val[ci]);
       state.last_dc_val[ci] = s;
       if (block)
         (*block)[0] = (JCOEF)s;