commit dbdf6d210b7e34d66df8b08596c690b9b12e7f8a
author Matt Sarett <msarett@google.com> Tue Nov 08 15:26:56 2016 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Tue Nov 08 21:39:15 2016 +0000
tree 332212922222c484e9137f628b793b8426b6447a
parent 2c3db3263bdc4b91cd7d21dbfe0501fe9bd476a5

Fail jpeg decodes on too many progressive scans

BUG:642462

GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=4560

Change-Id: I22891ce1e0b3a1bedefc34dadd5cf34dfc301b79
Reviewed-on: https://skia-review.googlesource.com/4560
Reviewed-by: Leon Scroggins <scroggo@google.com>
Commit-Queue: Matt Sarett <msarett@google.com>

resources/invalid_images/many-progressive-scans.jpg

diff --git a/resources/invalid_images/many-progressive-scans.jpg b/resources/invalid_images/many-progressive-scans.jpg
new file mode 100644
index 0000000..05a1a00
--- /dev/null
+++ b/resources/invalid_images/many-progressive-scans.jpg
Binary files differ

src/codec/SkJpegDecoderMgr.cpp

diff --git a/src/codec/SkJpegDecoderMgr.cpp b/src/codec/SkJpegDecoderMgr.cpp
index 70401c0..c2837aa 100644
--- a/src/codec/SkJpegDecoderMgr.cpp
+++ b/src/codec/SkJpegDecoderMgr.cpp
@@ -25,6 +25,17 @@
     print_message(info, "output_message");
 }
 
+static void progress_monitor(j_common_ptr info) {
+  int scan = ((j_decompress_ptr)info)->input_scan_number;
+  // Progressive images with a very large number of scans can cause the
+  // decoder to hang.  Here we use the progress monitor to abort on
+  // a very large number of scans.  100 is arbitrary, but much larger
+  // than the number of scans we might expect in a normal image.
+  if (scan >= 100) {
+      skjpeg_err_exit(info);
+  }
+}
+
 bool JpegDecoderMgr::returnFalse(const char caller[]) {
     print_message((j_common_ptr) &fDInfo, caller);
     return false;
@@ -71,6 +82,8 @@
     fInit = true;
     fDInfo.src = &fSrcMgr;
     fDInfo.err->output_message = &output_message;
+    fDInfo.progress = &fProgressMgr;
+    fProgressMgr.progress_monitor = &progress_monitor;
 }
 
 JpegDecoderMgr::~JpegDecoderMgr() {

src/codec/SkJpegDecoderMgr.h

diff --git a/src/codec/SkJpegDecoderMgr.h b/src/codec/SkJpegDecoderMgr.h
index 7bc422d..272c5b4 100644
--- a/src/codec/SkJpegDecoderMgr.h
+++ b/src/codec/SkJpegDecoderMgr.h
@@ -68,6 +68,7 @@
     jpeg_decompress_struct fDInfo;
     skjpeg_source_mgr      fSrcMgr;
     skjpeg_error_mgr       fErrorMgr;
+    jpeg_progress_mgr      fProgressMgr;
     bool                   fInit;
 };
 

tests/CodecTest.cpp

diff --git a/tests/CodecTest.cpp b/tests/CodecTest.cpp
index 32ad9596..dacabca 100644
--- a/tests/CodecTest.cpp
+++ b/tests/CodecTest.cpp
@@ -1439,4 +1439,5 @@
     // ASAN will complain if there is an issue.
     test_invalid_images(r, "invalid_images/int_overflow.ico", false);
     test_invalid_images(r, "invalid_images/skbug5887.gif", true);
+    test_invalid_images(r, "invalid_images/many-progressive-scans.jpg", false);
 }