diff --git a/apps/plugins/imageviewer/jpeg/jpeg_decoder.c b/apps/plugins/imageviewer/jpeg/jpeg_decoder.c index 98566affe8..39da52cc30 100644 --- a/apps/plugins/imageviewer/jpeg/jpeg_decoder.c +++ b/apps/plugins/imageviewer/jpeg/jpeg_decoder.c @@ -519,6 +519,7 @@ int process_markers(unsigned char* p_src, long size, struct jpeg* p_jpeg) break; case 0xC0: /* SOF Huff - Baseline DCT */ + case 0xC1: /* SOF Huff - Extended sequential DCT (8 bit samples) */ { ret |= SOF0; marker_size = *p_src++ << 8; /* Highbyte */ @@ -569,7 +570,6 @@ int process_markers(unsigned char* p_src, long size, struct jpeg* p_jpeg) } break; - case 0xC1: /* SOF Huff - Extended sequential DCT*/ case 0xC2: /* SOF Huff - Progressive DCT*/ case 0xC3: /* SOF Huff - Spatial (sequential) lossless*/ case 0xC5: /* SOF Huff - Differential sequential DCT*/ @@ -695,18 +695,27 @@ int process_markers(unsigned char* p_src, long size, struct jpeg* p_jpeg) ret |= DQT; marker_size = *p_src++ << 8; /* Highbyte */ marker_size |= *p_src++; /* Lowbyte */ - n = (marker_size-2)/(QUANT_TABLE_LENGTH+1); /* # of tables */ - for (i=0; i QUANT_TABLE_LENGTH) /* a table */ { - int id = *p_src++; /* ID */ - if (id >= 4) + int id = *p_src++; /* Pq: precision, Tq: ID */ + int pq = id >> 4; + id &= 0x0F; + if (id >= 4 || pq > 1 + || p_seg_end - p_src < QUANT_TABLE_LENGTH * (pq + 1)) { return (-8); /* Unsupported quantization table */ } /* Read Quantisation table: */ for (j=0; jquanttable[id][j] = *p_src++; + { + int q = *p_src++; + if (pq) /* 16 bit entries (SOF1) */ + q = q << 8 | *p_src++; + p_jpeg->quanttable[id][j] = q; + } } + p_src = p_seg_end; } break; diff --git a/apps/recorder/jpeg_load.c b/apps/recorder/jpeg_load.c index e81aba8ddf..334b407774 100644 --- a/apps/recorder/jpeg_load.c +++ b/apps/recorder/jpeg_load.c @@ -1019,6 +1019,7 @@ static int process_markers(struct jpeg* p_jpeg) break; /* discard */ case 0xC0: /* SOF Huff - Baseline DCT */ + case 0xC1: /* SOF Huff - Extended sequential DCT (8 bit samples) */ { JDEBUGF("SOF marker "); ret |= SOF0; @@ -1082,7 +1083,6 @@ static int process_markers(struct jpeg* p_jpeg) } break; - case 0xC1: /* SOF Huff - Extended sequential DCT*/ case 0xC2: /* SOF Huff - Progressive DCT*/ case 0xC3: /* SOF Huff - Spatial (sequential) lossless*/ case 0xC5: /* SOF Huff - Differential sequential DCT*/ @@ -1231,20 +1231,25 @@ static int process_markers(struct jpeg* p_jpeg) marker_size |= e_getc(p_jpeg, -1); /* Lowbyte */ marker_size -= 2; - n = (marker_size)/(QUANT_TABLE_LENGTH+1); /* # of tables */ - for (i=0; i QUANT_TABLE_LENGTH) /* another table */ { - int id = e_getc(p_jpeg, -1); /* ID */ - marker_size--; - if (id >= 4) + int id = e_getc(p_jpeg, -1); /* Pq: precision, Tq: ID */ + int pq = id >> 4; + id &= 0x0F; + marker_size -= 1 + QUANT_TABLE_LENGTH * (pq + 1); + if (id >= 4 || pq > 1 || marker_size < 0) { return (-8); /* Unsupported quantization table */ } /* Read Quantisation table: */ for (j=0; jquanttable[id][j] = e_getc(p_jpeg, -1); - marker_size--; + int q = e_getc(p_jpeg, -1); + if (pq) /* 16 bit entries (SOF1) */ + q = q << 8 | e_getc(p_jpeg, -1); + if (q > 8191) + return (-8); /* too big once scaled for the IDCT */ + p_jpeg->quanttable[id][j] = q; } } e_skip_bytes(p_jpeg, marker_size);