GitLab

JPEG images which were less than an MCU tall (in the case of ticket #475, 2 rows, with MCU size 16x16) could fall off the end of the table of pointers to output rows. This is because:

• the top level loop in rojpeg.c always tried to read a full MCU (16 here)
• this clashed with the bounds checking logic in romerge.c which clamped at the image height (2 here)
• the upsampler continued to be called for the remaining 14 rows, but had none, so fell into the case of returning 1 'spare' row until the line count went negative
• carried on trying to deliver (unsigned) 4 billion lines
• fell off the end of the table of pointers to output rows, and into the image data which for this sample was light grey (0xF3F3F3) and crashed with a bad memory access For extra garnish the image declared its resolution to be in dots per inch, but has them set to zero, leading to a divide by 0 in !Draw.

rojpeg.c: Limit rows requested to an MCU or the image height, whichever is smaller. Return a default DPI for JPEGs claiming 0dpi or 0dpcm.