Do not consume input of corrupt progressive JPEG

Source/platform/image-decoders/jpeg/JPEGImageDecoder.cpp

 /*
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * Portions are Copyright (C) 2001-6 mozilla.org
  *
  * Other contributors:
  *   Stuart Parmenter <stuart@mozilla.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ skipping 71 matching lines @@
 
 // JPEG only supports a denominator of 8.
 const unsigned scaleDenominator = 8;
 
 } // namespace
 
 namespace blink {
 
 struct decoder_error_mgr {
     struct jpeg_error_mgr pub; // "public" fields for IJG library
+    int num_corrupt_warnings;  // Counts corrupt warning messages
     jmp_buf setjmp_buffer;     // For handling catastropic errors
 };
 
 enum jstate {
     JPEG_HEADER,                 // Reading JFIF headers
     JPEG_START_DECOMPRESS,
     JPEG_DECOMPRESS_PROGRESSIVE, // Output progressive pixels
     JPEG_DECOMPRESS_SEQUENTIAL,  // Output sequential pixels
     JPEG_DONE,
     JPEG_ERROR
 };
 
 enum yuv_subsampling {
     YUV_UNKNOWN,
     YUV_410,
     YUV_411,
     YUV_420,
     YUV_422,
     YUV_440,
     YUV_444
 };
 
 void init_source(j_decompress_ptr jd);
 boolean fill_input_buffer(j_decompress_ptr jd);
 void skip_input_data(j_decompress_ptr jd, long num_bytes);
 void term_source(j_decompress_ptr jd);
 void error_exit(j_common_ptr cinfo);
+void emit_message(j_common_ptr cinfo, int msg_level);
 
 // Implementation of a JPEG src object that understands our state machine
 struct decoder_source_mgr {
     // public fields; must be first in this struct!
     struct jpeg_source_mgr pub;
 
     JPEGImageReader* decoder;
 };
 
 static unsigned readUint16(JOCTET* data, bool isBigEndian)
@@ skipping 337 matching lines @@
 #endif
             if (overrideColorSpace == JCS_YCbCr) {
                 m_info.out_color_space = JCS_YCbCr;
                 m_info.raw_data_out = TRUE;
                 m_uvSize = computeYUVSize(&m_info, 1, ImageDecoder::SizeForMemoryAllocation); // U size and V size have to be the same if we got here
             }
 
             // Don't allocate a giant and superfluous memory buffer when the
             // image is a sequential JPEG.
             m_info.buffered_image = jpeg_has_multiple_scans(&m_info);
+            if (m_info.buffered_image) {
+                m_err.pub.emit_message = emit_message;
+                m_err.num_corrupt_warnings = 0;
+            }
 
             if (onlySize) {
                 // We can stop here. Reduce our buffer length and available data.
                 m_bufferLength -= m_info.src->bytes_in_buffer;
                 m_info.src->bytes_in_buffer = 0;
                 return true;
             }
         // FALL THROUGH
 
         case JPEG_START_DECOMPRESS:
             // Set parameters for decompression.
             // FIXME -- Should reset dct_method and dither mode for final pass
             // of progressive JPEG.
             m_info.dct_method = dctMethod();
             m_info.dither_mode = ditherMode();
             m_info.do_fancy_upsampling = doFancyUpsampling();
+            m_info.do_block_smoothing = true;
             m_info.enable_2pass_quant = false;
-            m_info.do_block_smoothing = true;
+            // FIXME: should we just assert these?
+            m_info.enable_external_quant = false;
+            m_info.enable_1pass_quant = false;
+            m_info.quantize_colors = false;
+            m_info.colormap = 0;
 
             // Make a one-row-high sample array that will go away when done with
             // image. Always make it big enough to hold an RGB row. Since this
             // uses the IJG memory manager, it must be allocated before the call
             // to jpeg_start_compress().
             // FIXME: note that some output color spaces do not need the samples
             // buffer. Remove this allocation for those color spaces.
             {
                 int samplesWidth = (m_info.out_color_space == JCS_YCbCr) ? computeYUVSize(&m_info, 0, ImageDecoder::SizeForMemoryAllocation).width() : m_info.output_width;
                 m_samples = (*m_info.mem->alloc_sarray)(reinterpret_cast<j_common_ptr>(&m_info), JPOOL_IMAGE, samplesWidth * 4, 1);
@@ skipping 16 matching lines @@
                 // If we've completed image output...
                 ASSERT(m_info.output_scanline == m_info.output_height);
                 m_state = JPEG_DONE;
             }
         // FALL THROUGH
 
         case JPEG_DECOMPRESS_PROGRESSIVE:
             if (m_state == JPEG_DECOMPRESS_PROGRESSIVE) {
                 int status;
                 do {
+                    decoder_error_mgr* err = reinterpret_cast_ptr<decoder_error_mgr *>(m_info.err);
+                    if (err->num_corrupt_warnings)
+                        break;
                     status = jpeg_consume_input(&m_info);
                 } while ((status != JPEG_SUSPENDED) && (status != JPEG_REACHED_EOI));
 
                 for (;;) {
                     if (!m_info.output_scanline) {
                         int scan = m_info.input_scan_number;
 
                         // If we haven't displayed anything yet
                         // (output_scan_number == 0) and we have enough data for
                         // a complete scan, force output of the last full scan.
@@ skipping 95 matching lines @@
 
 #if USE(QCMSLIB)
     qcms_transform* m_transform;
 #endif
 };
 
 // Override the standard error method in the IJG JPEG decoder code.
 void error_exit(j_common_ptr cinfo)
 {
     // Return control to the setjmp point.
-    decoder_error_mgr *err = reinterpret_cast_ptr<decoder_error_mgr *>(cinfo->err);
+    decoder_error_mgr* err = reinterpret_cast_ptr<decoder_error_mgr *>(cinfo->err);
     longjmp(err->setjmp_buffer, -1);
 }
 
+void emit_message(j_common_ptr cinfo, int msg_level)
+{
+    if (msg_level >= 0)
+        return;
+
+    decoder_error_mgr* err = reinterpret_cast_ptr<decoder_error_mgr *>(cinfo->err);
+    err->pub.num_warnings++;
+
+    // Detect and count corrupt JPEG warning messages.
+    const char* warning = 0;
+    int code = err->pub.msg_code;
+    if (code > 0 && code <= err->pub.last_jpeg_message)
+        warning = err->pub.jpeg_message_table[code];
+    if (warning && !strncmp("Corrupt JPEG", warning, 12))
+        err->num_corrupt_warnings++;
+}
+
 void init_source(j_decompress_ptr)
 {
 }
 
 void skip_input_data(j_decompress_ptr jd, long num_bytes)
 {
     decoder_source_mgr *src = (decoder_source_mgr *)jd->src;
     src->decoder->skipBytes(num_bytes);
 }
 
@@ skipping 302 matching lines @@
     // has failed.
     if (!m_reader->decode(*m_data, onlySize) && isAllDataReceived())
         setFailed();
 
     // If decoding is done or failed, we don't need the JPEGImageReader anymore.
     if (isComplete(this, onlySize) || failed())
         m_reader.clear();
 }
 
 }