From 6cef2b10599118857c2c44776cf8c46581daa622 Mon Sep 17 00:00:00 2001 From: DRC Date: Wed, 30 Oct 2013 22:12:37 +0000 Subject: [PATCH] Fix a really subtle issue whereby an invalid free() could occur if a program called tjInitDecompress() and then accidentally passed the handle to tjEncodeYUV2(), or if a program called tjInitCompress() and then accidentally passed the handle to tjDecompressToYUV(). git-svn-id: svn+ssh://svn.code.sf.net/p/libjpeg-turbo/code/branches/1.3.x@1064 632fc199-4ca6-4c93-a231-07263d6284db --- turbojpeg.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/turbojpeg.c b/turbojpeg.c index b10de49..7a735a1 100644 --- a/turbojpeg.c +++ b/turbojpeg.c @@ -686,16 +686,16 @@ DLLEXPORT int DLLCALL tjEncodeYUV2(tjhandle handle, unsigned char *srcBuf, unsigned char *rgbBuf=NULL; #endif - getinstance(handle); - if((this->init&COMPRESS)==0) - _throw("tjEncodeYUV2(): Instance has not been initialized for compression"); - for(i=0; iinit&COMPRESS)==0) + _throw("tjEncodeYUV2(): Instance has not been initialized for compression"); + if(srcBuf==NULL || width<=0 || pitch<0 || height<=0 || pixelFormat<0 || pixelFormat>=TJ_NUMPF || dstBuf==NULL || subsamp<0 || subsamp>=NUMSUBOPT) @@ -1048,15 +1048,15 @@ DLLEXPORT int DLLCALL tjDecompressToYUV(tjhandle handle, tmpbufsize=0, usetmpbuf=0, th[MAX_COMPONENTS]; JSAMPLE *_tmpbuf=NULL, *ptr=dstBuf; JSAMPROW *tmpbuf[MAX_COMPONENTS]; - getinstance(handle); - if((this->init&DECOMPRESS)==0) - _throw("tjDecompressToYUV(): Instance has not been initialized for decompression"); - for(i=0; iinit&DECOMPRESS)==0) + _throw("tjDecompressToYUV(): Instance has not been initialized for decompression"); + if(jpegBuf==NULL || jpegSize<=0 || dstBuf==NULL) _throw("tjDecompressToYUV(): Invalid argument"); -- 2.40.0