image/jpeg: divide by zero

[catenacyber]

Go version

gotip (regression likely introduced in 30d8734)

Output of go env in your module/workspace:

AR='ar'
CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1913583260=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/src/ngolo-fuzzing/go.mod'
GOMODCACHE='/root/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/root/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/src/goroot'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/root/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/src/goroot/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.27-devel_26d8a902 Wed Mar 25 11:02:45 2026 -0700'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Run https://go.dev/play/p/d0KL5F3JUYK?v=gotip

What did you see happen?

Hello, 世界
panic: runtime error: integer divide by zero

goroutine 1 [running]:
image/jpeg.(*decoder).convertToRGB(0x2daded53a008)
/usr/local/go-faketime/src/image/jpeg/reader.go:767 +0x285
image/jpeg.(*decoder).decode(0x2daded53a008, {0x582e60?, 0x2daded528150?}, 0x0)
/usr/local/go-faketime/src/image/jpeg/reader.go:666 +0x445
image/jpeg.Decode(...)
/usr/local/go-faketime/src/image/jpeg/reader.go:778
main.main()
/tmp/sandbox2562788838/prog.go:13 +0x129

Program exited.

What did you expect to see?

The program finishing and printing Hello without panicing

[catenacyber]

cc @rolandshoemaker who told me to create this public issue as it is gotip only

[rolandshoemaker]

cc @nigeltao who reviewed the change, and @taichimaeda who wrote the patch that introduced this.

It seems like this is a result of removing the check that the maximum factors evenly divide the sampling factors (which were replaced with the inverse check, that the sampling factors evenly divide the maximum factors), causing us to end up with a cScale that is 0.

[gabyhelp]

Related Issues

• x/image/tiff: integer divide by zero #10711 (closed)
• x/image/tiff: integer divide by zero #10393 (closed)
• image/jpeg: invalid memory address or nil pointer dereference #10389 (closed)
• image/jpeg: index out of range #10388 (closed)
• image/jpeg panics when decoding progressive jpeg #5112 (closed)
• image/jpeg: panic while decoding a JPEG image #4259 (closed)
• image/png: makeslice: len out of range in Decode with insane image size #54586
• image/jpeg: panic: runtime error: index out of range #10154 (closed)
• x/image/font/plan9font: slice bounds out of range again #57258 (closed)
• image: decode panic: runtime error: makeslice: len out of range #45694

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/760701 mentions this issue: image/jpeg: reject RGB and non-standard chroma subsampling