From: DRC <information@libjpeg-turbo.org>
Date: Sun, 19 Nov 2017 15:18:36 +0000 (-0600)
Subject: tjLoadImage(): Fix OOB array access w/TJPF_UNKNOWN
X-Git-Tag: 1.5.90~49
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9f1f86bf7f6555e56e69fca4ecf002bf7041194c;p=libjpeg-turbo

tjLoadImage(): Fix OOB array access w/TJPF_UNKNOWN

Because the previous commit added a test for TJPF_UNKNOWN to tjunittest,
the ASAN CI build detected this issue.
---

diff --git a/turbojpeg.c b/turbojpeg.c
index 771b904..41d0611 100644
--- a/turbojpeg.c
+++ b/turbojpeg.c
@@ -1987,7 +1987,8 @@ DLLEXPORT unsigned char* DLLCALL tjLoadImage(const char *filename, int *width,
 		retval=-1;  goto bailout;
 	}
 
-	cinfo->in_color_space=pf2cs[*pixelFormat];
+	if(*pixelFormat==TJPF_UNKNOWN) cinfo->in_color_space=JCS_UNKNOWN;
+	else cinfo->in_color_space=pf2cs[*pixelFormat];
 	if(tempc=='B')
 	{
 		if((src=jinit_read_bmp(cinfo, FALSE))==NULL)