Attempt to fix heap buffer overflow in smallfry.

danielgtaylor / jpeg-archive

Utilities for archiving JPEGs for long term storage.

1.17k stars 121 forks source link

Attempt to fix heap buffer overflow in smallfry. #112

Closed jlebar closed 4 years ago

jlebar commented 4 years ago

Fixes #24.

I believe this matches the intent of the original programmer, although I am not at all sure.

Inside of this loop, HDVAL(j, 2) reads two strides (i.e. widths) past the current location. Therefore height - 1 is not sufficient to keep it in-bounds.

lfos commented 4 years ago

Merged, thanks!