Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Vulnerability - Action Required: heap-based buffer overflow vulnerability may in your project #103

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Security Vulnerability - Action Required: heap-based buffer overflow vulnerability may in your project #103

wants to merge 1 commit into from

Commits on Sep 7, 2024

  1. Lossless decomp: Range-limit 12-bit samples 

    12-bit is the only data precision for which the range of the sample data
type exceeds the valid sample range, so it is possible to craft a 12-bit
lossless JPEG image that contains out-of-range 12-bit samples.
Attempting to decompress such an image using color quantization or merged
upsampling (NOTE: libjpeg-turbo cannot generate YCbCr or subsampled
lossless JPEG images, but it can decompress them) caused segfaults or
buffer overruns when those algorithms attempted to use the out-of-range
sample values as array indices.  This commit modifies the lossless
decompressor so that it range-limits the output of the scaler when using
12-bit samples.
    @Crispy-fried-chicken
    Crispy-fried-chicken authored Sep 7, 2024
    Configuration menu
    Copy the full SHA
    b1855b3 View commit details
    Browse the repository at this point in the history