Jpeg sampling factor validation #1894

src/ImageSharp/Formats/Jpeg/Components/Decoder/JpegComponent.cs

@@ -19,21 +19,10 @@ public JpegComponent(MemoryAllocator memoryAllocator, JpegFrame frame, byte id,
             this.Frame = frame;
             this.Id = id;
 
-            // Validate sampling factors.
-            if (horizontalFactor == 0 || verticalFactor == 0)
-            {
-                JpegThrowHelper.ThrowBadSampling();
-            }
-
             this.HorizontalSamplingFactor = horizontalFactor;
             this.VerticalSamplingFactor = verticalFactor;
             this.SamplingFactors = new Size(this.HorizontalSamplingFactor, this.VerticalSamplingFactor);
 
-            if (quantizationTableIndex > 3)
-            {
-                JpegThrowHelper.ThrowBadQuantizationTableIndex(quantizationTableIndex);
-            }
-
             this.QuantizationTableIndex = quantizationTableIndex;
             this.Index = index;
         }

src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs

@@ -1022,10 +1022,26 @@ private void ProcessStartOfFrameMarker(BufferedReadStream stream, int remaining,
             int index = 0;
             for (int i = 0; i < componentCount; i++)
             {
+                // 1 byte: component identifier
+                byte componentId = this.temp[index];
+
+                // 1 byte: component sampling factors
                 byte hv = this.temp[index + 1];
                 int h = (hv >> 4) & 15;
                 int v = hv & 15;
 
+                // Validate: 1-4 range
+                if (h is < 1 or > 4)
+                {
+                    JpegThrowHelper.ThrowBadSampling(h);
+                }
+
+                // Validate: 1-4 range
+                if (v is < 1 or > 4)
+                {
+                    JpegThrowHelper.ThrowBadSampling(v);
+                }
+
                 if (maxH < h)
                 {
                     maxH = h;
@@ -1036,10 +1052,19 @@ private void ProcessStartOfFrameMarker(BufferedReadStream stream, int remaining,
                     maxV = v;
                 }
 
-                var component = new JpegComponent(this.Configuration.MemoryAllocator, this.Frame, this.temp[index], h, v, this.temp[index + 2], i);
+                // 1 byte: quantization table destination selector
+                byte quantTableIndex = this.temp[index + 2];
+
+                // Validate: 0-3 range
+                if (quantTableIndex > 3)
+                {
+                    JpegThrowHelper.ThrowBadQuantizationTableIndex(quantTableIndex);
+                }
+
+                var component = new JpegComponent(this.Configuration.MemoryAllocator, this.Frame, componentId, h, v, quantTableIndex, i);
 
                 this.Frame.Components[i] = component;
-                this.Frame.ComponentIds[i] = component.Id;
+                this.Frame.ComponentIds[i] = componentId;
 
                 index += componentBytes;
             }

src/ImageSharp/Formats/Jpeg/JpegThrowHelper.cs

@@ -22,23 +22,6 @@ internal static class JpegThrowHelper
         [MethodImpl(InliningOptions.ColdPath)]
         public static void ThrowInvalidImageContentException(string errorMessage) => throw new InvalidImageContentException(errorMessage);
 
-        /// <summary>
-        /// Cold path optimization for throwing <see cref="InvalidImageContentException"/>'s.
-        /// </summary>
-        /// <param name="errorMessage">The error message for the exception.</param>
-        /// <param name="innerException">The exception that is the cause of the current exception, or a null reference
-        /// if no inner exception is specified.</param>
-        [MethodImpl(InliningOptions.ColdPath)]
-        public static void ThrowInvalidImageContentException(string errorMessage, Exception innerException) => throw new InvalidImageContentException(errorMessage, innerException);
-
-        /// <summary>
-        /// Cold path optimization for throwing <see cref="NotImplementedException"/>'s
-        /// </summary>
-        /// <param name="errorMessage">The error message for the exception.</param>
-        [MethodImpl(InliningOptions.ColdPath)]
-        public static void ThrowNotImplementedException(string errorMessage)
-            => throw new NotImplementedException(errorMessage);
-
         [MethodImpl(InliningOptions.ColdPath)]
         public static void ThrowBadMarker(string marker, int length) => throw new InvalidImageContentException($"Marker {marker} has bad length {length}.");
 
@@ -51,6 +34,9 @@ public static void ThrowNotImplementedException(string errorMessage)
         [MethodImpl(InliningOptions.ColdPath)]
         public static void ThrowBadSampling() => throw new InvalidImageContentException("Bad sampling factor.");
 
+        [MethodImpl(InliningOptions.ColdPath)]
+        public static void ThrowBadSampling(int factor) => throw new InvalidImageContentException($"Bad sampling factor: {factor}");
+
         [MethodImpl(InliningOptions.ColdPath)]
         public static void ThrowBadProgressiveScan(int ss, int se, int ah, int al) => throw new InvalidImageContentException($"Invalid progressive parameters Ss={ss} Se={se} Ah={ah} Al={al}.");
 

tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs

@@ -40,9 +40,6 @@ public partial class JpegDecoderTests
                 // LibJpeg can open this despite incorrect colorspace metadata.
                 TestImages.Jpeg.Issues.IncorrectColorspace855,
 
-                // LibJpeg can open this despite the invalid subsampling units.
-                TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C,
-
                 // High depth images
                 TestImages.Jpeg.Baseline.Testorig12bit,
             };
@@ -90,7 +87,8 @@ public partial class JpegDecoderTests
             TestImages.Jpeg.Issues.Fuzz.AccessViolationException827,
             TestImages.Jpeg.Issues.Fuzz.ExecutionEngineException839,
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException1693A,
-            TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException1693B
+            TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException1693B,
+            TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C,
         };
 
         private static readonly Dictionary<string, float> CustomToleranceValues =