summaryrefslogtreecommitdiffstats
path: root/src/file_jpg.c
diff options
context:
space:
mode:
authorChristophe Grenier <grenier@cgsecurity.org>2011-04-03 18:13:37 +0200
committerChristophe Grenier <grenier@cgsecurity.org>2011-04-03 18:13:37 +0200
commit5b6c527665ca57bf2aca8c70436fb2fef1d9bbb3 (patch)
tree0888074b78816c909ae7e14b9600c42b369c562d /src/file_jpg.c
parent785602ec29ec09a2de4e2ce00f13b5b61ff6d2a5 (diff)
Add warning or workaround for libjpeg-turbo
Diffstat (limited to 'src/file_jpg.c')
-rw-r--r--src/file_jpg.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/src/file_jpg.c b/src/file_jpg.c
index 0f89811..a2d2308 100644
--- a/src/file_jpg.c
+++ b/src/file_jpg.c
@@ -928,8 +928,9 @@ static void jpg_check_picture(file_recovery_t *file_recovery)
}
else
{
- jpeg_session.frame = (unsigned char *)MALLOC(jpeg_session.output_height * jpeg_session.row_stride);
- memset(jpeg_session.frame, 0x80, jpeg_session.row_stride * jpeg_session.cinfo.output_height);
+ /* FIXME out of bound read access in libjpeg-turbo */
+ jpeg_session.frame = (unsigned char *)MALLOC((jpeg_session.output_height+1) * jpeg_session.row_stride);
+ memset(jpeg_session.frame, 0x80, (jpeg_session.cinfo.output_height+1) * jpeg_session.row_stride);
}
while (jpeg_session.cinfo.output_scanline < jpeg_session.cinfo.output_height)
{