Add helper to validate JPEG decode subsampling factors

Source/platform/image-decoders/jpeg/JPEGImageDecoder.cpp

 /*
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * Portions are Copyright (C) 2001-6 mozilla.org
  *
  * Other contributors:
  *   Stuart Parmenter <stuart@mozilla.com>
  *
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
@@ skipping 281 matching lines @@
                 return YUV_410;
             default:
                 break;
             }
         }
     }
 
     return YUV_UNKNOWN;
 }
 
+bool validateSubsampling(const jpeg_decompress_struct* cinfo)
+{
+    ASSERT(cinfo->num_components);
+
+    jpeg_component_info* component = cinfo->comp_info;
+    for (int c = 0; c < cinfo->num_components; ++c, ++component) {
+        if (component->h_samp_factor == 3)
+            component->h_samp_factor = 1;
+        if (component->v_samp_factor == 3)
+            component->v_samp_factor = 1;
+    }
+
+    return true;
+}
+
 class JPEGImageReader {
     WTF_MAKE_FAST_ALLOCATED(JPEGImageReader);
 public:
     JPEGImageReader(JPEGImageDecoder* decoder)
         : m_decoder(decoder)
         , m_bufferLength(0)
         , m_bytesToSkip(0)
         , m_state(JPEG_HEADER)
         , m_samples(0)
 #if USE(QCMSLIB)
@@ skipping 77 matching lines @@
         if (m_bytesToSkip)
             skipBytes(m_bytesToSkip);
 
         m_bufferLength = data.size();
 
         // We need to do the setjmp here. Otherwise bad things will happen
         if (setjmp(m_err.setjmp_buffer))
             return m_decoder->setFailed();
 
         J_COLOR_SPACE overrideColorSpace = JCS_UNKNOWN;
+
         switch (m_state) {
         case JPEG_HEADER:
             // Read file parameters with jpeg_read_header().
             if (jpeg_read_header(&m_info, true) == JPEG_SUSPENDED)
                 return false; // I/O suspension.
 
             switch (m_info.jpeg_color_space) {
             case JCS_YCbCr:
                 // libjpeg can convert YCbCr image pixels to RGB.
                 m_info.out_color_space = rgbOutputColorSpace();
@@ skipping 16 matching lines @@
             case JCS_CMYK:
             case JCS_YCCK:
                 // libjpeg can convert YCCK to CMYK, but neither to RGB, so we
                 // manually convert CMKY to RGB.
                 m_info.out_color_space = JCS_CMYK;
                 break;
             default:
                 return m_decoder->setFailed();
             }
 
+            if (!validateSubsampling(&m_info))
+                return m_decoder->setFailed();
+
             m_state = JPEG_START_DECOMPRESS;
 
             // We can fill in the size now that the header is available.
             if (!m_decoder->setSize(m_info.image_width, m_info.image_height))
                 return false;
 
             // Calculate and set decoded size.
             m_info.scale_num = m_decoder->desiredScaleNumerator();
             m_info.scale_denom = scaleDenominator;
             // Scaling caused by running low on memory isn't supported by YUV decoding since
@@ skipping 557 matching lines @@
     // has failed.
     if (!m_reader->decode(*m_data, onlySize) && isAllDataReceived())
         setFailed();
     // If we're done decoding the image, we don't need the JPEGImageReader
     // anymore.  (If we failed, |m_reader| has already been cleared.)
     else if ((!m_frameBufferCache.isEmpty() && (m_frameBufferCache[0].status() == ImageFrame::FrameComplete)) || (hasImagePlanes() && !onlySize))
         m_reader.clear();
 }
 
 }