File libjpeg-turbo-CVE-2020-35538.patch of Package libjpeg-turbo.25864
Index: libjpeg-turbo-1.5.3/jdapistd.c
===================================================================
--- libjpeg-turbo-1.5.3.orig/jdapistd.c
+++ libjpeg-turbo-1.5.3/jdapistd.c
@@ -21,6 +21,8 @@
#include "jinclude.h"
#include "jdmainct.h"
#include "jdcoefct.h"
+#include "jdmaster.h"
+#include "jdmerge.h"
#include "jdsample.h"
#include "jmemsys.h"
@@ -306,6 +308,16 @@ noop_quantize (j_decompress_ptr cinfo, J
}
+/* Dummy postprocessing function used by jpeg_skip_scanlines() */
+LOCAL(void)
+noop_post_process (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION *in_row_group_ctr,
+ JDIMENSION in_row_groups_avail, JSAMPARRAY output_buf,
+ JDIMENSION *out_row_ctr, JDIMENSION out_rows_avail)
+{
+}
+
+
/*
* In some cases, it is best to call jpeg_read_scanlines() and discard the
* output, rather than skipping the scanlines, because this allows us to
@@ -318,11 +330,17 @@ LOCAL(void)
read_and_discard_scanlines (j_decompress_ptr cinfo, JDIMENSION num_lines)
{
JDIMENSION n;
+ my_master_ptr master = (my_master_ptr)cinfo->master;
void (*color_convert) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
JDIMENSION input_row, JSAMPARRAY output_buf,
int num_rows);
void (*color_quantize) (j_decompress_ptr cinfo, JSAMPARRAY input_buf,
JSAMPARRAY output_buf, int num_rows) = NULL;
+ void (*post_process_data) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION *in_row_group_ctr,
+ JDIMENSION in_row_groups_avail,
+ JSAMPARRAY output_buf, JDIMENSION *out_row_ctr,
+ JDIMENSION out_rows_avail) = NULL;
color_convert = cinfo->cconvert->color_convert;
cinfo->cconvert->color_convert = noop_convert;
@@ -331,12 +349,21 @@ read_and_discard_scanlines (j_decompress
cinfo->cquantize->color_quantize = noop_quantize;
}
+ if (master->using_merged_upsample && cinfo->post &&
+ cinfo->post->post_process_data) {
+ post_process_data = cinfo->post->post_process_data;
+ cinfo->post->post_process_data = noop_post_process;
+ }
+
for (n = 0; n < num_lines; n++)
jpeg_read_scanlines(cinfo, NULL, 1);
cinfo->cconvert->color_convert = color_convert;
if (color_quantize)
cinfo->cquantize->color_quantize = color_quantize;
+
+ if (post_process_data)
+ cinfo->post->post_process_data = post_process_data;
}
@@ -379,7 +406,7 @@ jpeg_skip_scanlines (j_decompress_ptr ci
{
my_main_ptr main_ptr = (my_main_ptr) cinfo->main;
my_coef_ptr coef = (my_coef_ptr) cinfo->coef;
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_master_ptr master = (my_master_ptr) cinfo->master;
JDIMENSION i, x;
int y;
JDIMENSION lines_per_iMCU_row, lines_left_in_iMCU_row, lines_after_iMCU_row;
@@ -442,8 +469,16 @@ jpeg_skip_scanlines (j_decompress_ptr ci
main_ptr->buffer_full = FALSE;
main_ptr->rowgroup_ctr = 0;
main_ptr->context_state = CTX_PREPARE_FOR_IMCU;
- upsample->next_row_out = cinfo->max_v_samp_factor;
- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ if (master->using_merged_upsample) {
+ my_merged_upsample_ptr upsample =
+ (my_merged_upsample_ptr)cinfo->upsample;
+ upsample->spare_full = FALSE;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ } else {
+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
+ upsample->next_row_out = cinfo->max_v_samp_factor;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ }
}
/* Skipping is much simpler when context rows are not required. */
@@ -455,8 +490,16 @@ jpeg_skip_scanlines (j_decompress_ptr ci
cinfo->output_scanline += lines_left_in_iMCU_row;
main_ptr->buffer_full = FALSE;
main_ptr->rowgroup_ctr = 0;
- upsample->next_row_out = cinfo->max_v_samp_factor;
- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ if (master->using_merged_upsample) {
+ my_merged_upsample_ptr upsample =
+ (my_merged_upsample_ptr)cinfo->upsample;
+ upsample->spare_full = FALSE;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ } else {
+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
+ upsample->next_row_out = cinfo->max_v_samp_factor;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ }
}
}
@@ -491,7 +534,14 @@ jpeg_skip_scanlines (j_decompress_ptr ci
cinfo->output_iMCU_row += lines_to_skip / lines_per_iMCU_row;
increment_simple_rowgroup_ctr(cinfo, lines_to_read);
}
- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ if (master->using_merged_upsample) {
+ my_merged_upsample_ptr upsample =
+ (my_merged_upsample_ptr)cinfo->upsample;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ } else {
+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ }
return num_lines;
}
@@ -532,7 +582,13 @@ jpeg_skip_scanlines (j_decompress_ptr ci
* bit odd, since "rows_to_go" seems to be redundantly keeping track of
* output_scanline.
*/
- upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ if (master->using_merged_upsample) {
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr)cinfo->upsample;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ } else {
+ my_upsample_ptr upsample = (my_upsample_ptr)cinfo->upsample;
+ upsample->rows_to_go = cinfo->output_height - cinfo->output_scanline;
+ }
/* Always skip the requested number of lines. */
return num_lines;
Index: libjpeg-turbo-1.5.3/jdmerge.c
===================================================================
--- libjpeg-turbo-1.5.3.orig/jdmerge.c
+++ libjpeg-turbo-1.5.3/jdmerge.c
@@ -5,7 +5,7 @@
* Copyright (C) 1994-1996, Thomas G. Lane.
* libjpeg-turbo Modifications:
* Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
- * Copyright (C) 2009, 2011, 2014-2015, D. R. Commander.
+ * Copyright (C) 2009, 2011, 2014-2015, 2020, D. R. Commander.
* Copyright (C) 2013, Linaro Limited.
* For conditions of distribution and use, see the accompanying README.ijg
* file.
@@ -40,41 +40,13 @@
#define JPEG_INTERNALS
#include "jinclude.h"
#include "jpeglib.h"
+#include "jdmerge.h"
#include "jsimd.h"
#include "jconfigint.h"
#ifdef UPSAMPLE_MERGING_SUPPORTED
-/* Private subobject */
-
-typedef struct {
- struct jpeg_upsampler pub; /* public fields */
-
- /* Pointer to routine to do actual upsampling/conversion of one row group */
- void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
- JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf);
-
- /* Private state for YCC->RGB conversion */
- int *Cr_r_tab; /* => table for Cr to R conversion */
- int *Cb_b_tab; /* => table for Cb to B conversion */
- JLONG *Cr_g_tab; /* => table for Cr to G conversion */
- JLONG *Cb_g_tab; /* => table for Cb to G conversion */
-
- /* For 2:1 vertical sampling, we produce two output rows at a time.
- * We need a "spare" row buffer to hold the second output row if the
- * application provides just a one-row buffer; we also use the spare
- * to discard the dummy last row if the image height is odd.
- */
- JSAMPROW spare_row;
- boolean spare_full; /* T if spare buffer is occupied */
-
- JDIMENSION out_row_width; /* samples per output row */
- JDIMENSION rows_to_go; /* counts rows remaining in image */
-} my_upsampler;
-
-typedef my_upsampler *my_upsample_ptr;
-
#define SCALEBITS 16 /* speediest right-shift on some machines */
#define ONE_HALF ((JLONG) 1 << (SCALEBITS-1))
#define FIX(x) ((JLONG) ((x) * (1L<<SCALEBITS) + 0.5))
@@ -189,7 +161,7 @@ typedef my_upsampler *my_upsample_ptr;
LOCAL(void)
build_ycc_rgb_table (j_decompress_ptr cinfo)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
int i;
JLONG x;
SHIFT_TEMPS
@@ -232,7 +204,7 @@ build_ycc_rgb_table (j_decompress_ptr ci
METHODDEF(void)
start_pass_merged_upsample (j_decompress_ptr cinfo)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
/* Mark the spare buffer empty */
upsample->spare_full = FALSE;
@@ -255,7 +227,7 @@ merged_2v_upsample (j_decompress_ptr cin
JDIMENSION out_rows_avail)
/* 2:1 vertical sampling case: may need a spare row. */
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
JSAMPROW work_ptrs[2];
JDIMENSION num_rows; /* number of rows returned to caller */
@@ -307,7 +279,7 @@ merged_1v_upsample (j_decompress_ptr cin
JDIMENSION out_rows_avail)
/* 1:1 vertical sampling case: much easier, never need a spare row. */
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
/* Just do the upsampling. */
(*upsample->upmethod) (cinfo, input_buf, *in_row_group_ctr,
@@ -576,11 +548,11 @@ h2v2_merged_upsample_565D (j_decompress_
GLOBAL(void)
jinit_merged_upsampler (j_decompress_ptr cinfo)
{
- my_upsample_ptr upsample;
+ my_merged_upsample_ptr upsample;
- upsample = (my_upsample_ptr)
+ upsample = (my_merged_upsample_ptr)
(*cinfo->mem->alloc_small) ((j_common_ptr) cinfo, JPOOL_IMAGE,
- sizeof(my_upsampler));
+ sizeof(my_merged_upsampler));
cinfo->upsample = (struct jpeg_upsampler *) upsample;
upsample->pub.start_pass = start_pass_merged_upsample;
upsample->pub.need_context_rows = FALSE;
Index: libjpeg-turbo-1.5.3/jdmerge.h
===================================================================
--- /dev/null
+++ libjpeg-turbo-1.5.3/jdmerge.h
@@ -0,0 +1,47 @@
+/*
+ * jdmerge.h
+ *
+ * This file was part of the Independent JPEG Group's software:
+ * Copyright (C) 1994-1996, Thomas G. Lane.
+ * libjpeg-turbo Modifications:
+ * Copyright (C) 2020, D. R. Commander.
+ * For conditions of distribution and use, see the accompanying README.ijg
+ * file.
+ */
+
+#define JPEG_INTERNALS
+#include "jpeglib.h"
+
+#ifdef UPSAMPLE_MERGING_SUPPORTED
+
+
+/* Private subobject */
+
+typedef struct {
+ struct jpeg_upsampler pub; /* public fields */
+
+ /* Pointer to routine to do actual upsampling/conversion of one row group */
+ void (*upmethod) (j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
+ JDIMENSION in_row_group_ctr, JSAMPARRAY output_buf);
+
+ /* Private state for YCC->RGB conversion */
+ int *Cr_r_tab; /* => table for Cr to R conversion */
+ int *Cb_b_tab; /* => table for Cb to B conversion */
+ JLONG *Cr_g_tab; /* => table for Cr to G conversion */
+ JLONG *Cb_g_tab; /* => table for Cb to G conversion */
+
+ /* For 2:1 vertical sampling, we produce two output rows at a time.
+ * We need a "spare" row buffer to hold the second output row if the
+ * application provides just a one-row buffer; we also use the spare
+ * to discard the dummy last row if the image height is odd.
+ */
+ JSAMPROW spare_row;
+ boolean spare_full; /* T if spare buffer is occupied */
+
+ JDIMENSION out_row_width; /* samples per output row */
+ JDIMENSION rows_to_go; /* counts rows remaining in image */
+} my_merged_upsampler;
+
+typedef my_merged_upsampler *my_merged_upsample_ptr;
+
+#endif /* UPSAMPLE_MERGING_SUPPORTED */
Index: libjpeg-turbo-1.5.3/jdmrg565.c
===================================================================
--- libjpeg-turbo-1.5.3.orig/jdmrg565.c
+++ libjpeg-turbo-1.5.3/jdmrg565.c
@@ -20,7 +20,7 @@ h2v1_merged_upsample_565_internal (j_dec
JDIMENSION in_row_group_ctr,
JSAMPARRAY output_buf)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
register int y, cred, cgreen, cblue;
int cb, cr;
register JSAMPROW outptr;
@@ -91,7 +91,7 @@ h2v1_merged_upsample_565D_internal (j_de
JDIMENSION in_row_group_ctr,
JSAMPARRAY output_buf)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
register int y, cred, cgreen, cblue;
int cb, cr;
register JSAMPROW outptr;
@@ -165,7 +165,7 @@ h2v2_merged_upsample_565_internal (j_dec
JDIMENSION in_row_group_ctr,
JSAMPARRAY output_buf)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
register int y, cred, cgreen, cblue;
int cb, cr;
register JSAMPROW outptr0, outptr1;
@@ -261,7 +261,7 @@ h2v2_merged_upsample_565D_internal (j_de
JDIMENSION in_row_group_ctr,
JSAMPARRAY output_buf)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
register int y, cred, cgreen, cblue;
int cb, cr;
register JSAMPROW outptr0, outptr1;
Index: libjpeg-turbo-1.5.3/jdmrgext.c
===================================================================
--- libjpeg-turbo-1.5.3.orig/jdmrgext.c
+++ libjpeg-turbo-1.5.3/jdmrgext.c
@@ -4,7 +4,7 @@
* This file was part of the Independent JPEG Group's software:
* Copyright (C) 1994-1996, Thomas G. Lane.
* libjpeg-turbo Modifications:
- * Copyright (C) 2011, 2015, D. R. Commander.
+ * Copyright (C) 2011, 2015, 2020, D. R. Commander.
* For conditions of distribution and use, see the accompanying README.ijg
* file.
*
@@ -26,7 +26,7 @@ h2v1_merged_upsample_internal (j_decompr
JDIMENSION in_row_group_ctr,
JSAMPARRAY output_buf)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
register int y, cred, cgreen, cblue;
int cb, cr;
register JSAMPROW outptr;
@@ -99,7 +99,7 @@ h2v2_merged_upsample_internal (j_decompr
JDIMENSION in_row_group_ctr,
JSAMPARRAY output_buf)
{
- my_upsample_ptr upsample = (my_upsample_ptr) cinfo->upsample;
+ my_merged_upsample_ptr upsample = (my_merged_upsample_ptr) cinfo->upsample;
register int y, cred, cgreen, cblue;
int cb, cr;
register JSAMPROW outptr0, outptr1;
