[RESTRICT AUTOMERGE] TJBench: Fix errors when decomp. files w/ ICC data
This is a backport of an upstream commit. Original commit message
included the following:
"""
Embedded ICC profiles can cause the size of a JPEG file to exceed the
size returned by tjBufSize() (which is really meant to be used for
compression anyhow, not for decompression), and this was causing a
segfault (C) or an ArrayIndexOutOfBoundsException (Java) when
decompressing such files with TJBench. This commit modifies the
benchmark such that, when tiled decompression is disabled, it re-uses
the source buffer as the primary JPEG buffer.
"""
This commit was pulled in due to a SEGFAULT that appeared after
backporting the fix to the original bug.
Bug: 120551338
Test: tj64 /data/local/tmp/crash-46.jpg
See b/120551338#comment1 to get crash-46.jpg
Change-Id: Ia480d23a5581027da11a2da168c06448161668bf
(cherry picked from commit 87ccce3a16a600ff52b91741421f23583bc146e3)
diff --git a/README.android b/README.android
index a6d00d3..ba6a9ce 100644
--- a/README.android
+++ b/README.android
@@ -40,3 +40,9 @@
Cherry picked from upstream:
https://github.com/libjpeg-turbo/libjpeg-turbo/commit/2a9e3bd7430cfda1bc812d139e0609c6aca0b884
+(6) java/TJBench.java, tjbench.c
+Fix logical errors when decompressing ICC data
+This was pulled in due to a SEGFAULT that occurs when running the
+proof-of-concept for (5)
+Cherry picked from upstream:
+https://github.com/libjpeg-turbo/libjpeg-turbo/commit/11eec4a398f3fc1b9d39c1d3b81b53ae85d9b5e6
diff --git a/java/TJBench.java b/java/TJBench.java
index 383be46..9e8cdc4 100644
--- a/java/TJBench.java
+++ b/java/TJBench.java
@@ -1,5 +1,5 @@
/*
- * Copyright (C)2009-2014, 2016 D. R. Commander. All Rights Reserved.
+ * Copyright (C)2009-2014, 2016-2017 D. R. Commander. All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
@@ -591,8 +591,8 @@
System.out.print("N/A N/A ");
jpegBuf = new byte[1][TJ.bufSize(_tilew, _tileh, subsamp)];
jpegSize = new int[1];
+ jpegBuf[0] = srcBuf;
jpegSize[0] = srcSize;
- System.arraycopy(srcBuf, 0, jpegBuf[0], 0, srcSize);
}
if (w == tilew)
diff --git a/tjbench.c b/tjbench.c
index c62582e..4fe6ec0 100644
--- a/tjbench.c
+++ b/tjbench.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C)2009-2016 D. R. Commander. All Rights Reserved.
+ * Copyright (C)2009-2017 D. R. Commander. All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
@@ -683,7 +683,9 @@
{
if(quiet==1) printf("N/A N/A ");
jpegsize[0]=srcsize;
- memcpy(jpegbuf[0], srcbuf, srcsize);
+ free(jpegbuf[0]);
+ jpegbuf[0]=srcbuf;
+ srcbuf=NULL;
}
if(w==tilew) _tilew=_w;
