dany/pdfio
1
0
Fork 0
mirror of https://github.com/michaelrsweet/pdfio.git synced 2025-08-29 07:12:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix copy_jpeg with invalid/corrupt JPEG data (Issue #132)

Browse Source
This commit is contained in:
Michael R Sweet
2025-07-28 19:04:17 +01:00
parent d3a5fa9e0b
commit a54e2886a6
2 changed files with 100 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.md
View File

@@ -7,6 +7,7 @@ v1.5.4 - YYYY-MM-DD
- Updated indirect reference reading code to limit the range of generation
numbers.
- Fixed a JPEG copy bug (Issue #132)
v1.5.3 - 2025-05-03

15
pdfio-content.c
View File

@@ -2527,8 +2527,12 @@ copy_jpeg(pdfio_dict_t *dict, // I - Dictionary
bufend += bytes;
}
if (*bufptr == _PDFIO_JPEG_MARKER)
if (*bufptr != _PDFIO_JPEG_MARKER)
{
_pdfioFileError(dict->pdf, "Invalid JPEG data: <%02X>", *bufptr);
goto finish;
}
// Start of a marker in the file...
bufptr ++;
@@ -2536,13 +2540,11 @@ copy_jpeg(pdfio_dict_t *dict, // I - Dictionary
length = (size_t)((bufptr[1] << 8) | bufptr[2]);
bufptr += 3;
if (marker == _PDFIO_JPEG_MARKER)
continue;
else if (marker == _PDFIO_JPEG_EOI || marker == _PDFIO_JPEG_SOS || length < 2)
break;
PDFIO_DEBUG("copy_jpeg: JPEG X'FF%02X' (length %u)\n", marker, (unsigned)length);
if (marker == _PDFIO_JPEG_EOI || marker == _PDFIO_JPEG_SOS || length < 2)
break;
length -= 2;
if ((marker >= _PDFIO_JPEG_SOF0 && marker <= _PDFIO_JPEG_SOF3) || (marker >= _PDFIO_JPEG_SOF5 && marker <= _PDFIO_JPEG_SOF7) || (marker >= _PDFIO_JPEG_SOF9 && marker <= _PDFIO_JPEG_SOF11) || (marker >= _PDFIO_JPEG_SOF13 && marker <= _PDFIO_JPEG_SOF15))
@@ -2648,7 +2650,6 @@ copy_jpeg(pdfio_dict_t *dict, // I - Dictionary
}
}
}
}
if (width == 0 || height == 0 || (num_colors != 1 && num_colors != 3))
{