Attachment 160506 Details for Bug 202763 – Fix undefined behavior in mozjpeg's jcdctmgr.c

[patch] Fix undefined behavior in mozjpeg's jcdctmgr.c

graphics__mozjpeg-fix-quantize-ub-1.diff (text/plain), 2.12 KB, created by Dimitry Andric on 2015-08-30 00:27:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dimitry Andric

Created: 2015-08-30 00:27:26 UTC

Size: 2.12 KB

patch

obsolete

>Index: graphics/mozjpeg/files/patch-jcdctmgr.c
>===================================================================
>--- graphics/mozjpeg/files/patch-jcdctmgr.c	(revision 0)
>+++ graphics/mozjpeg/files/patch-jcdctmgr.c	(working copy)
>@@ -0,0 +1,41 @@
>+--- jcdctmgr.c.orig	2015-05-18 16:28:09.000000000 +0200
>++++ jcdctmgr.c	2015-08-30 02:21:25.079140000 +0200
>+@@ -6,7 +6,7 @@
>+  * libjpeg-turbo Modifications:
>+  * Copyright (C) 1999-2006, MIYASAKA Masaru.
>+  * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
>+- * Copyright (C) 2011, 2014 D. R. Commander
>++ * Copyright (C) 2011, 2014-2015 D. R. Commander
>+  * mozjpeg Modifications:
>+  * Copyright (C) 2014, Mozilla Corporation.
>+  * For conditions of distribution and use, see the accompanying README file.
>+@@ -185,6 +185,19 @@ compute_reciprocal (UINT16 divisor, DCTE
>+   UDCTELEM c;
>+   int b, r;
>+ 
>++  if (divisor == 1) {
>++    /* divisor == 1 means unquantized, so these reciprocal/correction/shift
>++     * values will cause the C quantization algorithm to act like the
>++     * identity function.  Since only the C quantization algorithm is used in
>++     * these cases, the scale value is irrelevant.
>++     */
>++    dtbl[DCTSIZE2 * 0] = (DCTELEM) 1;                       /* reciprocal */
>++    dtbl[DCTSIZE2 * 1] = (DCTELEM) 0;                       /* correction */
>++    dtbl[DCTSIZE2 * 2] = (DCTELEM) 1;                       /* scale */
>++    dtbl[DCTSIZE2 * 3] = (DCTELEM) (-sizeof(DCTELEM) * 8);  /* shift */
>++    return 0;
>++  }
>++
>+   b = flss(divisor) - 1;
>+   r  = sizeof(DCTELEM) * 8 + b;
>+ 
>+@@ -589,7 +602,8 @@ quantize (JCOEFPTR coef_block, DCTELEM *
>+ 
>+ #if BITS_IN_JSAMPLE == 8
>+ 
>+-  UDCTELEM recip, corr, shift;
>++  UDCTELEM recip, corr;
>++  int shift;
>+   UDCTELEM2 product;
>+ 
>+   for (i = 0; i < DCTSIZE2; i++) {
>
>Property changes on: graphics/mozjpeg/files/patch-jcdctmgr.c
>___________________________________________________________________
>Added: fbsd:nokeywords
>## -0,0 +1 ##
>+yes
>\ No newline at end of property
>Added: svn:eol-style
>## -0,0 +1 ##
>+native
>\ No newline at end of property
>Added: svn:mime-type
>## -0,0 +1 ##
>+text/plain
>\ No newline at end of property

Actions: View | Diff

Attachments on bug 202763: 160506