Add bounds checks to jpeg parsing code.

Change: 140740851
tensorflow · Dec 1, 2016 · 5e0c9ff · 5e0c9ff
1 parent 30004dd
commit 5e0c9ff
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/tensorflow/core/lib/jpeg/jpeg_handle.cc b/tensorflow/core/lib/jpeg/jpeg_handle.cc
@@ -147,8 +147,16 @@ void MemTermSource(j_decompress_ptr cinfo) {}
 // -----------------------------------------------------------------------------
 void MemSkipInputData(j_decompress_ptr cinfo, long jump) {
   MemSourceMgr *src = reinterpret_cast<MemSourceMgr *>(cinfo->src);
-  src->pub.bytes_in_buffer -= jump;
-  src->pub.next_input_byte += jump;
+  if (jump < 0) {
+    return;
+  }
+  if (jump > src->pub.bytes_in_buffer) {
+    src->pub.bytes_in_buffer = 0;
+    (void)MemFillInputBuffer(cinfo);  // warn with a fake EOI or error
+  } else {
+    src->pub.bytes_in_buffer -= jump;
+    src->pub.next_input_byte += jump;
+  }
 }
 
 // -----------------------------------------------------------------------------