tree e52c4619dabf23cb6e2f7be3678a4d5719e081b4
parent 0ef076fb7b326dc201b4ab3bd30fefd4e35ad1c4
author DRC <information@libjpeg-turbo.org> 1454632478 -0600
committer Matt Sarett <msarett@google.com> 1458232322 +0000

Prevent overread when decoding malformed JPEG

The accelerated Huffman decoder was previously invoked if there were
> 128 bytes in the input buffer.  However, it is possible to construct a
JPEG image with Huffman blocks > 430 bytes in length
(http://stackoverflow.com/questions/2734678/jpeg-calculating-max-size).
While such images are pathological and could never be created by a
JPEG compressor, it is conceivable that an attacker could use such an
artifially-constructed image to trigger an input buffer overrun in the
libjpeg-turbo decompressor and thus gain access to some of the data on
the calling program's heap.

This patch simply increases the minimum buffer size for the accelerated
Huffman decoder to 512 bytes, which should (hopefully) accommodate any
possible input.

This addresses a major issue (LJT-01-005) identified in a security audit
by Cure53.

Cherry picked from upstream:
https://github.com/libjpeg-turbo/libjpeg-turbo/commit/0463f7c9aad060fcd56e98d025ce16185279e2bc

BUG:27494207
BUG:27480923

Change-Id: I94876fecafa8b7d7f31734cb21d2ca0f382802ec