Fix an extremely rare crash that can occur when compressing a very high-frequency MCU using quality 100 and no subsampling, and when dynamically allocating the JPEG buffer in the destination manager. Even with a test program designed specifically to reproduce the crash, it only occurred once in about 25 million iterations. More details here: https://sourceforge.net/p/libjpeg-turbo/bugs/64
git-svn-id: svn+ssh://svn.code.sf.net/p/libjpeg-turbo/code/branches/1.3.x@1365 632fc199-4ca6-4c93-a231-07263d6284db
diff --git a/jchuff.c b/jchuff.c
index 5afeb19..648d3fd 100644
--- a/jchuff.c
+++ b/jchuff.c
@@ -4,7 +4,7 @@
* This file was part of the Independent JPEG Group's software:
* Copyright (C) 1991-1997, Thomas G. Lane.
* libjpeg-turbo Modifications:
- * Copyright (C) 2009-2011, D. R. Commander.
+ * Copyright (C) 2009-2011, 2014 D. R. Commander.
* For conditions of distribution and use, see the accompanying README file.
*
* This file contains Huffman entropy encoding routines.
@@ -426,7 +426,7 @@
LOCAL(boolean)
flush_bits (working_state * state)
{
- JOCTET _buffer[BUFSIZE], *buffer;
+ JOCTET _buffer[BUFSIZE + 8], *buffer;
size_t put_buffer; int put_bits;
size_t bytes, bytestocopy; int localbuf = 0;
@@ -455,7 +455,7 @@
int temp, temp2, temp3;
int nbits;
int r, code, size;
- JOCTET _buffer[BUFSIZE], *buffer;
+ JOCTET _buffer[BUFSIZE + 8], *buffer;
size_t put_buffer; int put_bits;
int code_0xf0 = actbl->ehufco[0xf0], size_0xf0 = actbl->ehufsi[0xf0];
size_t bytes, bytestocopy; int localbuf = 0;