Skip to content

GitLab

Commit 4faa5ce2 authored by Paolo Bacchilega's avatar Paolo Bacchilega
Browse files

jpeg loader: do not scan more than output_height lines

parent 6e56da85
Hide whitespace changes
Inline Side-by-side
extensions/cairo_io/cairo-image-surface-jpeg.c
View file @ 4faa5ce2
......@@ -173,6 +173,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
unsigned char *surface_row;
JSAMPARRAY buffer;
int buffer_stride;
int scanned_lines;
JDIMENSION n_lines;
JSAMPARRAY buffer_row;
int l;
......@@ -298,6 +299,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
_cairo_metadata_set_has_alpha (metadata, FALSE);
surface_data = _cairo_image_surface_flush_and_get_data (surface);
surface_row = surface_data + line_start;
scanned_lines = 0;
switch (srcinfo.out_color_space) {
case JCS_CMYK:
......@@ -313,6 +315,8 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
goto stop_loading;
n_lines = jpeg_read_scanlines (&srcinfo, buffer, srcinfo.rec_outbuf_height);
if (scanned_lines + n_lines > output_height)
n_lines = output_height - scanned_lines;
buffer_row = buffer;
for (l = 0; l < n_lines; l++) {
......@@ -349,6 +353,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
surface_row += line_step;
buffer_row += buffer_stride;
scanned_lines += 1;
}
}
}
......@@ -361,6 +366,8 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
goto stop_loading;
n_lines = jpeg_read_scanlines (&srcinfo, buffer, srcinfo.rec_outbuf_height);
if (scanned_lines + n_lines > output_height)
n_lines = output_height - scanned_lines;
buffer_row = buffer;
for (l = 0; l < n_lines; l++) {
......@@ -381,6 +388,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
surface_row += line_step;
buffer_row += buffer_stride;
scanned_lines += 1;
}
}
}
......@@ -393,6 +401,8 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
goto stop_loading;
n_lines = jpeg_read_scanlines (&srcinfo, buffer, srcinfo.rec_outbuf_height);
if (scanned_lines + n_lines > output_height)
n_lines = output_height - scanned_lines;
buffer_row = buffer;
for (l = 0; l < n_lines; l++) {
......@@ -415,6 +425,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
surface_row += line_step;
buffer_row += buffer_stride;
scanned_lines += 1;
}
}
}
......@@ -440,6 +451,8 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
goto stop_loading;
n_lines = jpeg_read_scanlines (&srcinfo, buffer, srcinfo.rec_outbuf_height);
if (scanned_lines + n_lines > output_height)
n_lines = output_height - scanned_lines;
buffer_row = buffer;
for (l = 0; l < n_lines; l++) {
......@@ -466,6 +479,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
surface_row += line_step;
buffer_row += buffer_stride;
scanned_lines += 1;
}
}
}
......@@ -495,6 +509,8 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
goto stop_loading;
n_lines = jpeg_read_scanlines (&srcinfo, buffer, srcinfo.rec_outbuf_height);
if (scanned_lines + n_lines > output_height)
n_lines = output_height - scanned_lines;
buffer_row = buffer;
for (l = 0; l < n_lines; l++) {
......@@ -528,6 +544,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream *istream,
surface_row += line_step;
buffer_row += buffer_stride;
scanned_lines += 1;
}
}
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment