r1259 - in trunk/code: jpeg-6 renderer

[DONOTREPLY at icculus.org]

Author: ludwig
Date: 2008-02-14 06:13:42 -0500 (Thu, 14 Feb 2008)
New Revision: 1259

Modified:
   trunk/code/jpeg-6/jdatasrc.c
   trunk/code/jpeg-6/jpeglib.h
   trunk/code/renderer/tr_image_jpg.c
Log:
don't read more memory than available in jpg decode


Modified: trunk/code/jpeg-6/jdatasrc.c
===================================================================
--- trunk/code/jpeg-6/jdatasrc.c	2008-02-14 11:13:30 UTC (rev 1258)
+++ trunk/code/jpeg-6/jdatasrc.c	2008-02-14 11:13:42 UTC (rev 1259)
@@ -20,13 +20,18 @@
 #include "jpeglib.h"
 #include "jerror.h"
 
+#ifndef MIN
+#define MIN(a, b) ((a)<(b)?(a):(b))
+#endif
 
+
 /* Expanded data source object for stdio input */
 
 typedef struct {
   struct jpeg_source_mgr pub;	/* public fields */
 
-  unsigned char *infile;		/* source stream */
+  unsigned char *inbuf;		/* source stream */
+  size_t inbufbytes;
   JOCTET * buffer;		/* start of buffer */
   boolean start_of_file;	/* have we gotten any data yet? */
 } my_source_mgr;
@@ -91,13 +96,26 @@
 fill_input_buffer (j_decompress_ptr cinfo)
 {
   my_src_ptr src = (my_src_ptr) cinfo->src;
+  size_t nbytes = MIN(src->inbufbytes, INPUT_BUF_SIZE);
 
-  memcpy( src->buffer, src->infile, INPUT_BUF_SIZE );
+  if(!nbytes)
+  {
+    WARNMS(cinfo, JWRN_JPEG_EOF);
+    /* Insert a fake EOI marker */
+    src->buffer[0] = (JOCTET) 0xFF;
+    src->buffer[1] = (JOCTET) JPEG_EOI;
+    nbytes = 2;
+  }
+  else
+  {
+    memcpy( src->buffer, src->inbuf, nbytes);
 
-  src->infile += INPUT_BUF_SIZE;
+    src->inbuf += nbytes;
+    src->inbufbytes -= nbytes;
+  }
 
   src->pub.next_input_byte = src->buffer;
-  src->pub.bytes_in_buffer = INPUT_BUF_SIZE;
+  src->pub.bytes_in_buffer = nbytes;
   src->start_of_file = FALSE;
 
   return TRUE;
@@ -171,7 +189,7 @@
  */
 
 GLOBAL void
-jpeg_stdio_src (j_decompress_ptr cinfo, unsigned char *infile)
+jpeg_mem_src (j_decompress_ptr cinfo, unsigned char *inbuf, size_t size)
 {
   my_src_ptr src;
 
@@ -198,7 +216,8 @@
   src->pub.skip_input_data = skip_input_data;
   src->pub.resync_to_restart = jpeg_resync_to_restart; /* use default method */
   src->pub.term_source = term_source;
-  src->infile = infile;
+  src->inbuf = inbuf;
+  src->inbufbytes = size;
   src->pub.bytes_in_buffer = 0; /* forces fill_input_buffer on first read */
   src->pub.next_input_byte = NULL; /* until buffer loaded */
 }

Modified: trunk/code/jpeg-6/jpeglib.h
===================================================================
--- trunk/code/jpeg-6/jpeglib.h	2008-02-14 11:13:30 UTC (rev 1258)
+++ trunk/code/jpeg-6/jpeglib.h	2008-02-14 11:13:42 UTC (rev 1259)
@@ -874,7 +874,7 @@
 /* Standard data source and destination managers: stdio streams. */
 /* Caller is responsible for opening the file before and closing after. */
 EXTERN void jpeg_stdio_dest JPP((j_compress_ptr cinfo, FILE * outfile));
-EXTERN void jpeg_stdio_src JPP((j_decompress_ptr cinfo, unsigned char *infile));
+EXTERN void jpeg_mem_src JPP((j_decompress_ptr cinfo, unsigned char *buffer, size_t size));
 
 /* Default parameter setup for compression */
 EXTERN void jpeg_set_defaults JPP((j_compress_ptr cinfo));

Modified: trunk/code/renderer/tr_image_jpg.c
===================================================================
--- trunk/code/renderer/tr_image_jpg.c	2008-02-14 11:13:30 UTC (rev 1258)
+++ trunk/code/renderer/tr_image_jpg.c	2008-02-14 11:13:42 UTC (rev 1259)
@@ -56,6 +56,7 @@
   unsigned row_stride;		/* physical row width in output buffer */
   unsigned pixelcount, memcount;
   unsigned char *out;
+  int len;
   byte	*fbuffer;
   byte  *buf;
 
@@ -65,8 +66,8 @@
    * requires it in order to read binary files.
    */
 
-  ri.FS_ReadFile ( ( char * ) filename, (void **)&fbuffer);
-  if (!fbuffer) {
+  len = ri.FS_ReadFile ( ( char * ) filename, (void **)&fbuffer);
+  if (!fbuffer || len < 0) {
 	return;
   }
 
@@ -84,7 +85,7 @@
 
   /* Step 2: specify data source (eg, a file) */
 
-  jpeg_stdio_src(&cinfo, fbuffer);
+  jpeg_mem_src(&cinfo, fbuffer, len);
 
   /* Step 3: read file parameters with jpeg_read_header() */