Skip to content

Jpeg sampling factor validation #1894 #1899

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JimBobSquarePants merged 6 commits into from
Dec 20, 2021
Merged

Jpeg sampling factor validation #1894 #1899

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e045fbb
Sampling factor validation
Dec 17, 2021
48c0d82
Merge branch 'master' into dp/jpeg-sampling-factor-validation
JimBobSquarePants Dec 18, 2021
1f9ef3e
Removed unused methods, added new throw helper method
Dec 18, 2021
f3b8e5c
gfoidl IsOutOfRange
Dec 18, 2021
7ced497
Fixed tests
Dec 18, 2021
791a1a1
Merge branch 'master' into dp/jpeg-sampling-factor-validation
JimBobSquarePants Dec 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 0 additions & 11 deletions src/ImageSharp/Formats/Jpeg/Components/Decoder/JpegComponent.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,21 +19,10 @@ public JpegComponent(MemoryAllocator memoryAllocator, JpegFrame frame, byte id,
this.Frame = frame;
this.Id = id;

// Validate sampling factors.
if (horizontalFactor == 0 || verticalFactor == 0)
{
JpegThrowHelper.ThrowBadSampling();
}

this.HorizontalSamplingFactor = horizontalFactor;
this.VerticalSamplingFactor = verticalFactor;
this.SamplingFactors = new Size(this.HorizontalSamplingFactor, this.VerticalSamplingFactor);

if (quantizationTableIndex > 3)
{
JpegThrowHelper.ThrowBadQuantizationTableIndex(quantizationTableIndex);
}

this.QuantizationTableIndex = quantizationTableIndex;
this.Index = index;
}
Expand Down
29 changes: 27 additions & 2 deletions src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1022,10 +1022,26 @@ private void ProcessStartOfFrameMarker(BufferedReadStream stream, int remaining,
int index = 0;
for (int i = 0; i < componentCount; i++)
{
// 1 byte: component identifier
byte componentId = this.temp[index];

// 1 byte: component sampling factors
byte hv = this.temp[index + 1];
int h = (hv >> 4) & 15;
int v = hv & 15;

// Validate: 1-4 range
if (h is < 1 or > 4)
{
JpegThrowHelper.ThrowInvalidImageContentException($"Bad horizontal sampling factor: {h}");
}

// Validate: 1-4 range
if (v is < 1 or > 4)
{
JpegThrowHelper.ThrowInvalidImageContentException($"Bad vertical sampling factor: {v}");
}

if (maxH < h)
{
maxH = h;
Expand All @@ -1036,10 +1052,19 @@ private void ProcessStartOfFrameMarker(BufferedReadStream stream, int remaining,
maxV = v;
}

var component = new JpegComponent(this.Configuration.MemoryAllocator, this.Frame, this.temp[index], h, v, this.temp[index + 2], i);
// 1 byte: quantization table destination selector
byte quantTableIndex = this.temp[index + 2];

// Validate: 0-3 range
if (quantTableIndex > 3)
{
JpegThrowHelper.ThrowBadQuantizationTableIndex(quantTableIndex);
}

var component = new JpegComponent(this.Configuration.MemoryAllocator, this.Frame, componentId, h, v, quantTableIndex, i);

this.Frame.Components[i] = component;
this.Frame.ComponentIds[i] = component.Id;
this.Frame.ComponentIds[i] = componentId;

index += componentBytes;
}
Expand Down
6 changes: 2 additions & 4 deletions tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,6 @@ public partial class JpegDecoderTests
// LibJpeg can open this despite incorrect colorspace metadata.
TestImages.Jpeg.Issues.IncorrectColorspace855,

// LibJpeg can open this despite the invalid subsampling units.
TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C,

// High depth images
TestImages.Jpeg.Baseline.Testorig12bit,
};
Expand Down Expand Up @@ -90,7 +87,8 @@ public partial class JpegDecoderTests
TestImages.Jpeg.Issues.Fuzz.AccessViolationException827,
TestImages.Jpeg.Issues.Fuzz.ExecutionEngineException839,
TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException1693A,
TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException1693B
TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException1693B,
TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C,
};

private static readonly Dictionary<string, float> CustomToleranceValues =
Expand Down