Skip to content

Commit 3a691f4

Browse files
committed
Merge commit 'eadd243'
# By DRC # Via DRC * commit 'eadd243': Fix interblock smoothing with narrow prog. JPEGs jchuff.c/flush_bits(): Guard against free_bits < 0 jchuff.c/flush_bits(): Guard against put_bits < 0 Restore xform fuzzer behavior from before 19f9d8f xform fuzz: Use src subsamp to calc dst buf size Doc: Mention that we are a JPEG ref implementation jchuff.c: Test for out-of-range coefficients turbojpeg.h: Make customFilter() proto match doc ChangeLog.md: Fix typo tjTransform(): Calc dst buf size from xformed dims Fix build warnings/errs w/ -DNO_GETENV/-DNO_PUTENV GitHub: Fix x32 build tjexample.c: Prevent integer overflow jpeg_crop_scanline: Fix calc w/sclg + 2x4,4x2 samp Decomp: Don't enable 2-pass color quant w/ RGB565 TJBench: w/JPEG input imgs, set min tile= MCU size Bump version to 2.1.6 to prepare for new commits GitHub: Add pull request template Build: Clarify CMAKE_OSX_ARCHITECTURES error Build: Fail if included with add_subdirectory() # Conflicts: # .github/workflows/build.yml # CMakeLists.txt # README.md # release/deb-control.in
2 parents 3bd754e + eadd243 commit 3a691f4

25 files changed

Lines changed: 237 additions & 88 deletions

.github/pull_request_template.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
**Complete description of the bug fix or feature that this pull request implements**
2+
3+
4+
**Checklist before submitting the pull request, to maximize the chances that the pull request will be accepted**
5+
6+
- [ ] Read CONTRIBUTING.md, a link to which appears under "Helpful resources" below. That document discusses general guidelines for contributing to libjpeg-turbo, as well as the types of contributions that will not be accepted or are unlikely to be accepted.
7+
- [ ] Search the existing issues and pull requests (both open and closed) to ensure that a similar request has not already been submitted and rejected.
8+
- [ ] Discuss the proposed bug fix or feature in a GitHub issue, through direct e-mail with the project maintainer, or on the libjpeg-turbo-devel mailing list.

CMakeLists.txt

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,34 @@ pad_number(VERSION_MINOR 3)
3131
pad_number(VERSION_REVISION 3)
3232
set(LIBJPEG_TURBO_VERSION_NUMBER ${VERSION_MAJOR}${VERSION_MINOR}${VERSION_REVISION})
3333

34+
# The libjpeg-turbo build system has never supported and will never support
35+
# being integrated into another build system using add_subdirectory(), because
36+
# doing so would require that we (minimally):
37+
#
38+
# 1. avoid using certain CMake variables, such as CMAKE_SOURCE_DIR,
39+
# CMAKE_BINARY_DIR, and CMAKE_PROJECT_NAME;
40+
# 2. avoid using implicit include directories and relative paths;
41+
# 3. optionally provide a way to skip the installation of libjpeg-turbo
42+
# components when the 'install' target is built;
43+
# 4. optionally provide a way to postfix target names, to avoid namespace
44+
# conflicts;
45+
# 5. restructure the top-level CMakeLists.txt so that it properly sets the
46+
# PROJECT_VERSION variable; and
47+
# 6. design automated regression tests to ensure that new commits don't break
48+
# any of the above.
49+
#
50+
# Even if we did all of that, issues would still arise, because it is
51+
# impossible for an upstream build system to anticipate the widely varying
52+
# needs of every downstream build system. That's why the CMake
53+
# ExternalProject_Add() function exists. Downstream projects that wish to
54+
# integrate libjpeg-turbo as a subdirectory should either use
55+
# ExternalProject_Add() or make downstream modifications to the libjpeg-turbo
56+
# build system to suit their specific needs. Please do not file bug reports,
57+
# feature requests, or pull requests regarding this.
58+
if(NOT CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR)
59+
message(FATAL_ERROR "The libjpeg-turbo build system cannot be integrated into another build system using add_subdirectory(). Use ExternalProject_Add() instead.")
60+
endif()
61+
3462
# CMake 3.14 and later sets CMAKE_MACOSX_BUNDLE to TRUE by default when
3563
# CMAKE_SYSTEM_NAME is iOS, tvOS, or watchOS, which breaks the libjpeg-turbo
3664
# build. (Specifically, when CMAKE_MACOSX_BUNDLE is TRUE, executables for
@@ -70,7 +98,7 @@ string(TOLOWER ${CMAKE_SYSTEM_PROCESSOR} CMAKE_SYSTEM_PROCESSOR_LC)
7098
set(COUNT 1)
7199
foreach(ARCH ${CMAKE_OSX_ARCHITECTURES})
72100
if(COUNT GREATER 1)
73-
message(FATAL_ERROR "The libjpeg-turbo build system does not support multiple values in CMAKE_OSX_ARCHITECTURES.")
101+
message(FATAL_ERROR "libjpeg-turbo contains assembly code, so it cannot be built with multiple values in CMAKE_OSX_ARCHITECTURES.")
74102
endif()
75103
math(EXPR COUNT "${COUNT}+1")
76104
endforeach()

ChangeLog.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,44 @@
1+
2.1.6
2+
=====
3+
4+
### Significant changes relative to 2.1.5.1:
5+
6+
1. Fixed an oversight in 1.4 beta1[8] that caused various segfaults and buffer
7+
overruns when attempting to decompress various specially-crafted malformed
8+
12-bit-per-component JPEG images using a 12-bit-per-component build of djpeg
9+
(`-DWITH_12BIT=1`) with both color quantization and RGB565 color conversion
10+
enabled.
11+
12+
2. Fixed an issue whereby `jpeg_crop_scanline()` sometimes miscalculated the
13+
downsampled width for components with 4x2 or 2x4 subsampling factors if
14+
decompression scaling was enabled. This caused the components to be upsampled
15+
incompletely, which caused the color converter to read from uninitialized
16+
memory. With 12-bit data precision, this caused a buffer overrun or underrun
17+
and subsequent segfault if the sample value read from uninitialized memory was
18+
outside of the valid sample range.
19+
20+
3. Fixed a long-standing issue whereby the `tjTransform()` function, when used
21+
with the `TJXOP_TRANSPOSE`, `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or
22+
`TJXOP_ROT270` transform operation and without automatic JPEG destination
23+
buffer (re)allocation or lossless cropping, computed the worst-case transformed
24+
JPEG image size based on the source image dimensions rather than the
25+
transformed image dimensions. If a calling program allocated the JPEG
26+
destination buffer based on the transformed image dimensions, as the API
27+
documentation instructs, and attempted to transform a specially-crafted 4:2:2,
28+
4:4:0, or 4:1:1 JPEG source image containing a large amount of metadata, the
29+
issue caused `tjTransform()` to overflow the JPEG destination buffer rather
30+
than fail gracefully. The issue could be worked around by setting
31+
`TJXOPT_COPYNONE`. Note that, irrespective of this issue, `tjTransform()`
32+
cannot reliably transform JPEG source images that contain a large amount of
33+
metadata unless automatic JPEG destination buffer (re)allocation is used or
34+
`TJXOPT_COPYNONE` is set.
35+
36+
4. Fixed an issue that caused the C Huffman encoder (which is not used by
37+
default on x86 and Arm CPUs) to read from uninitialized memory when attempting
38+
to transform a specially-crafted malformed arithmetic-coded JPEG source image
39+
into a baseline Huffman-coded JPEG destination image.
40+
41+
142
2.1.5.1
243
=======
344

doc/html/functions.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
<div class="contents">
6666
<div class="textblock">Here is a list of all documented struct and union fields with links to the struct/union documentation for each field:</div><ul>
6767
<li>customFilter
68-
: <a class="el" href="structtjtransform.html#afd7fc262df33f741e120ef4183202ef5">tjtransform</a>
68+
: <a class="el" href="structtjtransform.html#a0dc7697d59a7abe48afc629e96cbc1d2">tjtransform</a>
6969
</li>
7070
<li>data
7171
: <a class="el" href="structtjtransform.html#a688fe8f1a8ecc12a538d9e561cf338e3">tjtransform</a>

doc/html/functions_vars.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
<div class="contents">
6666
&#160;<ul>
6767
<li>customFilter
68-
: <a class="el" href="structtjtransform.html#afd7fc262df33f741e120ef4183202ef5">tjtransform</a>
68+
: <a class="el" href="structtjtransform.html#a0dc7697d59a7abe48afc629e96cbc1d2">tjtransform</a>
6969
</li>
7070
<li>data
7171
: <a class="el" href="structtjtransform.html#a688fe8f1a8ecc12a538d9e561cf338e3">tjtransform</a>

doc/html/group___turbo_j_p_e_g.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2664,7 +2664,7 @@ <h2 class="memtitle"><span class="permalink"><a href="#ga9cb8abf4cc91881e04a0329
26642664
<tr><td class="paramname">dstBufs</td><td>pointer to an array of n byte buffers. <code>dstBufs[i]</code> will receive a JPEG image that has been transformed using the parameters in <code>transforms[i]</code>. TurboJPEG has the ability to reallocate the JPEG destination buffer to accommodate the size of the transformed JPEG image. Thus, you can choose to:<ol type="1">
26652665
<li>pre-allocate the JPEG destination buffer with an arbitrary size using <a class="el" href="group___turbo_j_p_e_g.html#gaec627dd4c5f30b7a775a7aea3bec5d83" title="Allocate a byte buffer for use with TurboJPEG.">tjAlloc()</a> and let TurboJPEG grow the buffer as needed,</li>
26662666
<li>set <code>dstBufs[i]</code> to NULL to tell TurboJPEG to allocate the buffer for you, or</li>
2667-
<li>pre-allocate the buffer to a "worst case" size determined by calling <a class="el" href="group___turbo_j_p_e_g.html#ga67ac12fee79073242cb216e07c9f1f90" title="The maximum size of the buffer (in bytes) required to hold a JPEG image with the given parameters.">tjBufSize()</a> with the transformed or cropped width and height. Under normal circumstances, this should ensure that the buffer never has to be re-allocated. (Setting <a class="el" href="group___turbo_j_p_e_g.html#ga8808d403c68b62aaa58a4c1e58e98963" title="Disable JPEG buffer (re)allocation.">TJFLAG_NOREALLOC</a> guarantees that it won't be.) Note, however, that there are some rare cases (such as transforming images with a large amount of embedded EXIF or ICC profile data) in which the transformed JPEG image will be larger than the worst-case size, and <a class="el" href="group___turbo_j_p_e_g.html#ga8808d403c68b62aaa58a4c1e58e98963" title="Disable JPEG buffer (re)allocation.">TJFLAG_NOREALLOC</a> cannot be used in those cases.</li>
2667+
<li>pre-allocate the buffer to a "worst case" size determined by calling <a class="el" href="group___turbo_j_p_e_g.html#ga67ac12fee79073242cb216e07c9f1f90" title="The maximum size of the buffer (in bytes) required to hold a JPEG image with the given parameters.">tjBufSize()</a> with the transformed or cropped width and height and the level of subsampling used in the source image. Under normal circumstances, this should ensure that the buffer never has to be re-allocated. (Setting <a class="el" href="group___turbo_j_p_e_g.html#ga8808d403c68b62aaa58a4c1e58e98963" title="Disable JPEG buffer (re)allocation.">TJFLAG_NOREALLOC</a> guarantees that it won't be.) Note, however, that there are some rare cases (such as transforming images with a large amount of embedded EXIF or ICC profile data) in which the transformed JPEG image will be larger than the worst-case size, and <a class="el" href="group___turbo_j_p_e_g.html#ga8808d403c68b62aaa58a4c1e58e98963" title="Disable JPEG buffer (re)allocation.">TJFLAG_NOREALLOC</a> cannot be used in those cases.</li>
26682668
</ol>
26692669
If you choose option 1, then <code>dstSizes[i]</code> should be set to the size of your pre-allocated buffer. In any case, unless you have set <a class="el" href="group___turbo_j_p_e_g.html#ga8808d403c68b62aaa58a4c1e58e98963" title="Disable JPEG buffer (re)allocation.">TJFLAG_NOREALLOC</a>, you should always check <code>dstBufs[i]</code> upon return from this function, as it may have changed.</td></tr>
26702670
<tr><td class="paramname">dstSizes</td><td>pointer to an array of n unsigned long variables that will receive the actual sizes (in bytes) of each transformed JPEG image. If <code>dstBufs[i]</code> points to a pre-allocated buffer, then <code>dstSizes[i]</code> should be set to the size of the buffer. Upon return, <code>dstSizes[i]</code> will contain the size of the transformed JPEG image (in bytes.)</td></tr>

doc/html/search/all_0.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
var searchData=
22
[
3-
['customfilter_0',['customFilter',['../structtjtransform.html#afd7fc262df33f741e120ef4183202ef5',1,'tjtransform']]]
3+
['customfilter_0',['customFilter',['../structtjtransform.html#a0dc7697d59a7abe48afc629e96cbc1d2',1,'tjtransform']]]
44
];

doc/html/search/variables_0.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
var searchData=
22
[
3-
['customfilter_142',['customFilter',['../structtjtransform.html#afd7fc262df33f741e120ef4183202ef5',1,'tjtransform']]]
3+
['customfilter_142',['customFilter',['../structtjtransform.html#a0dc7697d59a7abe48afc629e96cbc1d2',1,'tjtransform']]]
44
];

doc/html/structtjtransform.html

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -89,21 +89,21 @@
8989
<tr class="memitem:a688fe8f1a8ecc12a538d9e561cf338e3"><td class="memItemLeft" align="right" valign="top">void *&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="structtjtransform.html#a688fe8f1a8ecc12a538d9e561cf338e3">data</a></td></tr>
9090
<tr class="memdesc:a688fe8f1a8ecc12a538d9e561cf338e3"><td class="mdescLeft">&#160;</td><td class="mdescRight">Arbitrary data that can be accessed within the body of the callback function. <a href="structtjtransform.html#a688fe8f1a8ecc12a538d9e561cf338e3">More...</a><br /></td></tr>
9191
<tr class="separator:a688fe8f1a8ecc12a538d9e561cf338e3"><td class="memSeparator" colspan="2">&#160;</td></tr>
92-
<tr class="memitem:afd7fc262df33f741e120ef4183202ef5"><td class="memItemLeft" align="right" valign="top">int(*&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="structtjtransform.html#afd7fc262df33f741e120ef4183202ef5">customFilter</a> )(short *coeffs, <a class="el" href="structtjregion.html">tjregion</a> arrayRegion, <a class="el" href="structtjregion.html">tjregion</a> planeRegion, int componentIndex, int transformIndex, struct <a class="el" href="structtjtransform.html">tjtransform</a> *transform)</td></tr>
93-
<tr class="memdesc:afd7fc262df33f741e120ef4183202ef5"><td class="mdescLeft">&#160;</td><td class="mdescRight">A callback function that can be used to modify the DCT coefficients after they are losslessly transformed but before they are transcoded to a new JPEG image. <a href="structtjtransform.html#afd7fc262df33f741e120ef4183202ef5">More...</a><br /></td></tr>
94-
<tr class="separator:afd7fc262df33f741e120ef4183202ef5"><td class="memSeparator" colspan="2">&#160;</td></tr>
92+
<tr class="memitem:a0dc7697d59a7abe48afc629e96cbc1d2"><td class="memItemLeft" align="right" valign="top">int(*&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="structtjtransform.html#a0dc7697d59a7abe48afc629e96cbc1d2">customFilter</a> )(short *coeffs, <a class="el" href="structtjregion.html">tjregion</a> arrayRegion, <a class="el" href="structtjregion.html">tjregion</a> planeRegion, int componentID, int transformID, struct <a class="el" href="structtjtransform.html">tjtransform</a> *transform)</td></tr>
93+
<tr class="memdesc:a0dc7697d59a7abe48afc629e96cbc1d2"><td class="mdescLeft">&#160;</td><td class="mdescRight">A callback function that can be used to modify the DCT coefficients after they are losslessly transformed but before they are transcoded to a new JPEG image. <a href="structtjtransform.html#a0dc7697d59a7abe48afc629e96cbc1d2">More...</a><br /></td></tr>
94+
<tr class="separator:a0dc7697d59a7abe48afc629e96cbc1d2"><td class="memSeparator" colspan="2">&#160;</td></tr>
9595
</table>
9696
<a name="details" id="details"></a><h2 class="groupheader">Detailed Description</h2>
9797
<div class="textblock"><p>Lossless transform. </p>
9898
</div><h2 class="groupheader">Field Documentation</h2>
99-
<a id="afd7fc262df33f741e120ef4183202ef5"></a>
100-
<h2 class="memtitle"><span class="permalink"><a href="#afd7fc262df33f741e120ef4183202ef5">&#9670;&nbsp;</a></span>customFilter</h2>
99+
<a id="a0dc7697d59a7abe48afc629e96cbc1d2"></a>
100+
<h2 class="memtitle"><span class="permalink"><a href="#a0dc7697d59a7abe48afc629e96cbc1d2">&#9670;&nbsp;</a></span>customFilter</h2>
101101

102102
<div class="memitem">
103103
<div class="memproto">
104104
<table class="memname">
105105
<tr>
106-
<td class="memname">int(* tjtransform::customFilter) (short *coeffs, <a class="el" href="structtjregion.html">tjregion</a> arrayRegion, <a class="el" href="structtjregion.html">tjregion</a> planeRegion, int componentIndex, int transformIndex, struct <a class="el" href="structtjtransform.html">tjtransform</a> *transform)</td>
106+
<td class="memname">int(* tjtransform::customFilter) (short *coeffs, <a class="el" href="structtjregion.html">tjregion</a> arrayRegion, <a class="el" href="structtjregion.html">tjregion</a> planeRegion, int componentID, int transformID, struct <a class="el" href="structtjtransform.html">tjtransform</a> *transform)</td>
107107
</tr>
108108
</table>
109109
</div><div class="memdoc">

fuzz/transform.cc

Lines changed: 65 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C)2021 D. R. Commander. All Rights Reserved.
2+
* Copyright (C)2021, 2023 D. R. Commander. All Rights Reserved.
33
*
44
* Redistribution and use in source and binary forms, with or without
55
* modification, are permitted provided that the following conditions are met:
@@ -32,16 +32,13 @@
3232
#include <string.h>
3333

3434

35-
#define NUMXFORMS 3
36-
37-
3835
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
3936
{
4037
tjhandle handle = NULL;
41-
unsigned char *dstBufs[NUMXFORMS] = { NULL, NULL, NULL };
42-
unsigned long dstSizes[NUMXFORMS] = { 0, 0, 0 }, maxBufSize;
43-
int width = 0, height = 0, jpegSubsamp, jpegColorspace, i, t;
44-
tjtransform transforms[NUMXFORMS];
38+
unsigned char *dstBufs[1] = { NULL };
39+
unsigned long dstSizes[1] = { 0 }, maxBufSize;
40+
int width = 0, height = 0, jpegSubsamp, jpegColorspace, i;
41+
tjtransform transforms[1];
4542
#if defined(__has_feature) && __has_feature(memory_sanitizer)
4643
char env[18] = "JSIMD_FORCENONE=1";
4744

@@ -67,53 +64,84 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
6764
if (jpegSubsamp < 0 || jpegSubsamp >= TJ_NUMSAMP)
6865
jpegSubsamp = TJSAMP_444;
6966

70-
for (t = 0; t < NUMXFORMS; t++)
71-
memset(&transforms[t], 0, sizeof(tjtransform));
67+
memset(&transforms[0], 0, sizeof(tjtransform));
7268

7369
transforms[0].op = TJXOP_NONE;
7470
transforms[0].options = TJXOPT_PROGRESSIVE | TJXOPT_COPYNONE;
7571
dstBufs[0] = (unsigned char *)malloc(tjBufSize(width, height, jpegSubsamp));
7672
if (!dstBufs[0])
7773
goto bailout;
7874

79-
transforms[1].r.w = (width + 1) / 2;
80-
transforms[1].r.h = (height + 1) / 2;
81-
transforms[1].op = TJXOP_TRANSPOSE;
82-
transforms[1].options = TJXOPT_GRAY | TJXOPT_CROP | TJXOPT_COPYNONE;
83-
dstBufs[1] =
84-
(unsigned char *)malloc(tjBufSize((width + 1) / 2, (height + 1) / 2,
85-
TJSAMP_GRAY));
86-
if (!dstBufs[1])
75+
maxBufSize = tjBufSize(width, height, jpegSubsamp);
76+
77+
if (tjTransform(handle, data, size, 1, dstBufs, dstSizes, transforms,
78+
TJFLAG_LIMITSCANS | TJFLAG_NOREALLOC) == 0) {
79+
/* Touch all of the output pixels in order to catch uninitialized reads
80+
when using MemorySanitizer. */
81+
int sum = 0;
82+
83+
for (i = 0; i < dstSizes[0]; i++)
84+
sum += dstBufs[0][i];
85+
86+
/* Prevent the code above from being optimized out. This test should
87+
never be true, but the compiler doesn't know that. */
88+
if (sum > 255 * maxBufSize)
89+
goto bailout;
90+
}
91+
92+
free(dstBufs[0]);
93+
dstBufs[0] = NULL;
94+
95+
transforms[0].r.w = (height + 1) / 2;
96+
transforms[0].r.h = (width + 1) / 2;
97+
transforms[0].op = TJXOP_TRANSPOSE;
98+
transforms[0].options = TJXOPT_GRAY | TJXOPT_CROP | TJXOPT_COPYNONE;
99+
dstBufs[0] =
100+
(unsigned char *)malloc(tjBufSize((height + 1) / 2, (width + 1) / 2,
101+
jpegSubsamp));
102+
if (!dstBufs[0])
87103
goto bailout;
88104

89-
transforms[2].op = TJXOP_ROT90;
90-
transforms[2].options = TJXOPT_TRIM | TJXOPT_COPYNONE;
91-
dstBufs[2] = (unsigned char *)malloc(tjBufSize(height, width, jpegSubsamp));
92-
if (!dstBufs[2])
105+
maxBufSize = tjBufSize((height + 1) / 2, (width + 1) / 2, jpegSubsamp);
106+
107+
if (tjTransform(handle, data, size, 1, dstBufs, dstSizes, transforms,
108+
TJFLAG_LIMITSCANS | TJFLAG_NOREALLOC) == 0) {
109+
int sum = 0;
110+
111+
for (i = 0; i < dstSizes[0]; i++)
112+
sum += dstBufs[0][i];
113+
114+
if (sum > 255 * maxBufSize)
115+
goto bailout;
116+
}
117+
118+
free(dstBufs[0]);
119+
dstBufs[0] = NULL;
120+
121+
transforms[0].op = TJXOP_ROT90;
122+
transforms[0].options = TJXOPT_TRIM;
123+
dstBufs[0] = (unsigned char *)malloc(tjBufSize(height, width, jpegSubsamp));
124+
if (!dstBufs[0])
93125
goto bailout;
94126

95-
maxBufSize = tjBufSize(width, height, jpegSubsamp);
127+
maxBufSize = tjBufSize(height, width, jpegSubsamp);
96128

97-
if (tjTransform(handle, data, size, NUMXFORMS, dstBufs, dstSizes, transforms,
129+
if (tjTransform(handle, data, size, 1, dstBufs, dstSizes, transforms,
98130
TJFLAG_LIMITSCANS | TJFLAG_NOREALLOC) == 0) {
99-
/* Touch all of the output pixels in order to catch uninitialized reads
100-
when using MemorySanitizer. */
101-
for (t = 0; t < NUMXFORMS; t++) {
102-
int sum = 0;
131+
int sum = 0;
103132

104-
for (i = 0; i < dstSizes[t]; i++)
105-
sum += dstBufs[t][i];
133+
for (i = 0; i < dstSizes[0]; i++)
134+
sum += dstBufs[0][i];
106135

107-
/* Prevent the code above from being optimized out. This test should
108-
never be true, but the compiler doesn't know that. */
109-
if (sum > 255 * maxBufSize)
110-
goto bailout;
111-
}
136+
if (sum > 255 * maxBufSize)
137+
goto bailout;
112138
}
113139

114-
transforms[0].options &= ~TJXOPT_COPYNONE;
115140
free(dstBufs[0]);
116141
dstBufs[0] = NULL;
142+
143+
transforms[0].op = TJXOP_NONE;
144+
transforms[0].options = TJXOPT_PROGRESSIVE;
117145
dstSizes[0] = 0;
118146

119147
if (tjTransform(handle, data, size, 1, dstBufs, dstSizes, transforms,
@@ -128,8 +156,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
128156
}
129157

130158
bailout:
131-
for (t = 0; t < NUMXFORMS; t++)
132-
free(dstBufs[t]);
159+
free(dstBufs[0]);
133160
if (handle) tjDestroy(handle);
134161
return 0;
135162
}

0 commit comments

Comments
 (0)