@@ -837,6 +837,54 @@ final class TJUnitTest {
if (tjd != null) tjd.close();
}
+ static void overflowTest() throws Exception {
+ /* Ensure that the various buffer size methods don't overflow */
+ int size = 0;
+ boolean exception = false;
+ try {
+ exception = false;
+ size = TJ.bufSize(18919, 18919, TJ.SAMP_444);
+ } catch (Exception e) { exception = true; }
+ if (!exception || size != 0)
+ throw new Exception("TJ.bufSize() overflow");
+ try {
+ exception = false;
+ size = TJ.bufSizeYUV(26755, 1, 26755, TJ.SAMP_444);
+ } catch (Exception e) { exception = true; }
+ if (!exception || size != 0)
+ throw new Exception("TJ.bufSizeYUV() overflow");
+ try {
+ exception = false;
+ size = TJ.bufSizeYUV(26754, 3, 26754, TJ.SAMP_444);
+ } catch (Exception e) { exception = true; }
+ if (!exception || size != 0)
+ throw new Exception("TJ.bufSizeYUV() overflow");
+ try {
+ exception = false;
+ size = TJ.bufSizeYUV(26754, -1, 26754, TJ.SAMP_444);
+ } catch (Exception e) { exception = true; }
+ if (!exception || size != 0)
+ throw new Exception("TJ.bufSizeYUV() overflow");
+ try {
+ exception = false;
+ size = TJ.planeSizeYUV(0, 46341, 0, 46341, TJ.SAMP_444);
+ } catch (Exception e) { exception = true; }
+ if (!exception || size != 0)
+ throw new Exception("TJ.planeSizeYUV() overflow");
+ try {
+ exception = false;
+ size = TJ.planeWidth(0, Integer.MAX_VALUE, TJ.SAMP_420);
+ } catch (Exception e) { exception = true; }
+ if (!exception || size != 0)
+ throw new Exception("TJ.planeWidth() overflow");
+ try {
+ exception = false;
+ size = TJ.planeHeight(0, Integer.MAX_VALUE, TJ.SAMP_420);
+ } catch (Exception e) { exception = true; }
+ if (!exception || size != 0)
+ throw new Exception("TJ.planeHeight() overflow");
+ }
+
static void bufSizeTest() throws Exception {
int w, h, i, subsamp;
byte[] srcBuf, dstBuf = null;
@@ -912,6 +960,7 @@ final class TJUnitTest {
}
if (doYUV)
FORMATS_4BYTE[4] = -1;
+ overflowTest();
doTest(35, 39, bi ? FORMATS_3BYTEBI : FORMATS_3BYTE, TJ.SAMP_444,
testName);
doTest(39, 41, bi ? FORMATS_4BYTEBI : FORMATS_4BYTE, TJ.SAMP_444,
@@ -664,7 +664,7 @@ encode_mcu_AC_first(j_compress_ptr cinfo
emit_restart(entropy, entropy->next_restart_num);
#ifdef WITH_SIMD
- cvalue = values = (UJCOEF *)PAD((JUINTPTR)values_unaligned, 16);
+ cvalue = values = (UJCOEF *)PAD((size_t)values_unaligned, 16);
#else
/* Not using SIMD, so alignment is not needed */
cvalue = values = values_unaligned;
@@ -934,7 +934,7 @@ encode_mcu_AC_refine(j_compress_ptr cinf
emit_restart(entropy, entropy->next_restart_num);
#ifdef WITH_SIMD
- cabsvalue = absvalues = (UJCOEF *)PAD((JUINTPTR)absvalues_unaligned, 16);
+ cabsvalue = absvalues = (UJCOEF *)PAD((size_t)absvalues_unaligned, 16);
#else
/* Not using SIMD, so alignment is not needed */
cabsvalue = absvalues = absvalues_unaligned;
@@ -26,6 +26,7 @@
#include "jpeglib.h"
#include "jversion.h"
#include "jerror.h"
+#include <stdlib.h>
#ifdef USE_WINDOWS_MESSAGEBOX
#include <windows.h>
@@ -711,10 +711,10 @@ static void overflowTest(void)
CHECKSIZE(tj3YUVPlaneSize());
ulsize = tjPlaneSizeYUV(0, 65536, 0, 65536, TJSAMP_444);
CHECKSIZEUL(tjPlaneSizeYUV());
- intsize = tj3YUVPlaneWidth(0, INT_MAX, TJSAMP_420);
- CHECKSIZEINT(tj3YUVPlaneWidth());
- intsize = tj3YUVPlaneHeight(0, INT_MAX, TJSAMP_420);
- CHECKSIZEINT(tj3YUVPlaneHeight());
+ intsize = tjPlaneWidth(0, INT_MAX, TJSAMP_420);
+ CHECKSIZEINT(tjPlaneWidth());
+ intsize = tjPlaneHeight(0, INT_MAX, TJSAMP_420);
+ CHECKSIZEINT(tjPlaneHeight());
bailout:
return;
@@ -97,10 +97,10 @@
JNIEXPORT jint JNICALL Java_org_libjpegturbo_turbojpeg_TJ_bufSize
(JNIEnv *env, jclass cls, jint width, jint height, jint jpegSubsamp)
{
- size_t retval = tj3JPEGBufSize(width, height, jpegSubsamp);
+ unsigned long retval = tj3JPEGBufSize(width, height, jpegSubsamp);
- if (retval == 0) THROW_ARG(tj3GetErrorStr(NULL));
- if (retval > (size_t)INT_MAX)
+ if (retval == (unsigned long)-1) THROW_ARG(tj3GetErrorStr(NULL));
+ if (retval > (unsigned long)INT_MAX)
THROW_ARG("Image is too large");
bailout:
@@ -111,10 +111,10 @@ bailout:
JNIEXPORT jint JNICALL Java_org_libjpegturbo_turbojpeg_TJ_bufSizeYUV__IIII
(JNIEnv *env, jclass cls, jint width, jint align, jint height, jint subsamp)
{
- size_t retval = tj3YUVBufSize(width, align, height, subsamp);
+ unsigned long retval = tj3YUVBufSize(width, align, height, subsamp);
- if (retval == 0) THROW_ARG(tj3GetErrorStr(NULL));
- if (retval > (size_t)INT_MAX)
+ if (retval == unsigned long)-1) THROW_ARG(tj3GetErrorStr(NULL));
+ if (retval > (unsigned long)INT_MAX)
THROW_ARG("Image is too large");
bailout:
@@ -126,10 +126,10 @@ JNIEXPORT jint JNICALL Java_org_libjpegt
(JNIEnv *env, jclass cls, jint componentID, jint width, jint stride,
jint height, jint subsamp)
{
- size_t retval = tj3YUVPlaneSize(componentID, width, stride, height, subsamp);
+ unsigned long retval = tj3YUVPlaneSize(componentID, width, stride, height, subsamp);
- if (retval == 0) THROW_ARG(tj3GetErrorStr(NULL));
- if (retval > (size_t)INT_MAX)
+ if (retval == unsigned long)-1) THROW_ARG(tj3GetErrorStr(NULL));
+ if (retval > (unsigned long)INT_MAX)
THROW_ARG("Image is too large");
bailout: