fixing overrelease and out-of-bounds write, fixes #13725

[wxWidgets.git] / src / common / imagjpeg.cpp

diff --git a/src/common/imagjpeg.cpp b/src/common/imagjpeg.cpp
index 86dfa2da770a10349398879cb5c857a902dcb081..88bcb4f313d4cdd54a4f2cfb8d1141ea8b003639 100644 (file)
--- a/src/common/imagjpeg.cpp
+++ b/src/common/imagjpeg.cpp
@@ -17,6 +17,7 @@
 #if wxUSE_IMAGE && wxUSE_LIBJPEG
 
 #include "wx/imagjpeg.h"
+#include "wx/versioninfo.h"
 
 #ifndef WX_PRECOMP
     #include "wx/log.h"
@@ -28,7 +29,7 @@
 
 // A hack based on one from tif_jpeg.c to overcome the problem on Windows
 // of rpcndr.h defining boolean with a different type to the jpeg headers.
-// 
+//
 // This hack is only necessary for an external jpeg library, the builtin one
 // usually used on Windows doesn't use the type boolean, so always works.
 //
@@ -57,10 +58,6 @@ typedef boolean wxjpeg_boolean;
 // For JPEG library error handling
 #include <setjmp.h>
 
-#ifdef __SALFORDC__
-#undef FAR
-#endif
-
 // ----------------------------------------------------------------------------
 // types
 // ----------------------------------------------------------------------------
@@ -152,14 +149,11 @@ CPP_METHODDEF(void) wx_term_source ( j_decompress_ptr cinfo )
 
 // JPEG error manager:
 
-struct wx_error_mgr {
-  struct jpeg_error_mgr pub;    /* "public" fields */
-
+struct wx_error_mgr : public jpeg_error_mgr
+{
   jmp_buf setjmp_buffer;    /* for return to caller */
 };
 
-typedef struct wx_error_mgr * wx_error_ptr;
-
 /*
  * Here's the routine that will replace the standard error_exit method:
  */
@@ -167,14 +161,14 @@ typedef struct wx_error_mgr * wx_error_ptr;
 CPP_METHODDEF(void) wx_error_exit (j_common_ptr cinfo)
 {
   /* cinfo->err really points to a wx_error_mgr struct, so coerce pointer */
-  wx_error_ptr myerr = (wx_error_ptr) cinfo->err;
+  wx_error_mgr * const jerr = (wx_error_mgr *) cinfo->err;
 
   /* Always display the message. */
   /* We could postpone this until after returning, if we chose. */
   (*cinfo->err->output_message) (cinfo);
 
   /* Return control to the setjmp point */
-  longjmp(myerr->setjmp_buffer, 1);
+  longjmp(jerr->setjmp_buffer, 1);
 }
 
 /*
@@ -235,13 +229,19 @@ static inline void wx_cmyk_to_rgb(unsigned char* rgb, const unsigned char* cmyk)
 
 bool wxJPEGHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbose, int WXUNUSED(index) )
 {
+    wxCHECK_MSG( image, false, "NULL image pointer" );
+
     struct jpeg_decompress_struct cinfo;
-    struct wx_error_mgr jerr;
+    wx_error_mgr jerr;
     unsigned char *ptr;
 
+    // save this before calling Destroy()
+    const unsigned maxWidth = image->GetOptionInt(wxIMAGE_OPTION_MAX_WIDTH),
+                   maxHeight = image->GetOptionInt(wxIMAGE_OPTION_MAX_HEIGHT);
     image->Destroy();
-    cinfo.err = jpeg_std_error( &jerr.pub );
-    jerr.pub.error_exit = wx_error_exit;
+
+    cinfo.err = jpeg_std_error( &jerr );
+    jerr.error_exit = wx_error_exit;
 
     if (!verbose)
         cinfo.err->output_message = wx_ignore_message;
@@ -252,10 +252,12 @@ bool wxJPEGHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
        * We need to clean up the JPEG object, close the input file, and return.
        */
       if (verbose)
+      {
         wxLogError(_("JPEG: Couldn't load - file is probably corrupted."));
+      }
       (cinfo.src->term_source)(&cinfo);
       jpeg_destroy_decompress(&cinfo);
-      if (image->Ok()) image->Destroy();
+      if (image->IsOk()) image->Destroy();
       return false;
     }
 
@@ -275,10 +277,21 @@ bool wxJPEGHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
         bytesPerPixel = 3;
     }
 
+    // scale the picture to fit in the specified max size if necessary
+    if ( maxWidth > 0 || maxHeight > 0 )
+    {
+        unsigned& scale = cinfo.scale_denom;
+        while ( (maxWidth && (cinfo.image_width / scale > maxWidth)) ||
+                    (maxHeight && (cinfo.image_height / scale > maxHeight)) )
+        {
+            scale *= 2;
+        }
+    }
+
     jpeg_start_decompress( &cinfo );
 
-    image->Create( cinfo.image_width, cinfo.image_height );
-    if (!image->Ok()) {
+    image->Create( cinfo.output_width, cinfo.output_height );
+    if (!image->IsOk()) {
         jpeg_finish_decompress( &cinfo );
         jpeg_destroy_decompress( &cinfo );
         return false;
@@ -310,6 +323,24 @@ bool wxJPEGHandler::LoadFile( wxImage *image, wxInputStream& stream, bool verbos
         }
     }
 
+    // set up resolution if available: it's part of optional JFIF APP0 chunk
+    if ( cinfo.saw_JFIF_marker )
+    {
+        image->SetOption(wxIMAGE_OPTION_RESOLUTIONX, cinfo.X_density);
+        image->SetOption(wxIMAGE_OPTION_RESOLUTIONY, cinfo.Y_density);
+
+        // we use the same values for this option as libjpeg so we don't need
+        // any conversion here
+        image->SetOption(wxIMAGE_OPTION_RESOLUTIONUNIT, cinfo.density_unit);
+    }
+
+    if ( cinfo.image_width != cinfo.output_width || cinfo.image_height != cinfo.output_height )
+    {
+        // save the original image size
+        image->SetOption(wxIMAGE_OPTION_ORIGINAL_WIDTH, cinfo.image_width);
+        image->SetOption(wxIMAGE_OPTION_ORIGINAL_HEIGHT, cinfo.image_height);
+    }
+
     jpeg_finish_decompress( &cinfo );
     jpeg_destroy_decompress( &cinfo );
     return true;
@@ -382,13 +413,13 @@ GLOBAL(void) wx_jpeg_io_dest (j_compress_ptr cinfo, wxOutputStream& outfile)
 bool wxJPEGHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbose )
 {
     struct jpeg_compress_struct cinfo;
-    struct wx_error_mgr jerr;
+    wx_error_mgr jerr;
     JSAMPROW row_pointer[1];    /* pointer to JSAMPLE row[s] */
     JSAMPLE *image_buffer;
     int stride;                /* physical row width in image buffer */
 
-    cinfo.err = jpeg_std_error(&jerr.pub);
-    jerr.pub.error_exit = wx_error_exit;
+    cinfo.err = jpeg_std_error(&jerr);
+    jerr.error_exit = wx_error_exit;
 
     if (!verbose)
         cinfo.err->output_message = wx_ignore_message;
@@ -400,7 +431,9 @@ bool wxJPEGHandler::SaveFile( wxImage *image, wxOutputStream& stream, bool verbo
          * We need to clean up the JPEG object, close the input file, and return.
          */
          if (verbose)
+         {
             wxLogError(_("JPEG: Couldn't save image."));
+         }
          jpeg_destroy_compress(&cinfo);
          return false;
     }
@@ -458,7 +491,7 @@ bool wxJPEGHandler::DoCanRead( wxInputStream& stream )
 {
     unsigned char hdr[2];
 
-    if ( !stream.Read(hdr, WXSIZEOF(hdr)) )
+    if ( !stream.Read(hdr, WXSIZEOF(hdr)) )     // it's ok to modify the stream position here
         return false;
 
     return hdr[0] == 0xFF && hdr[1] == 0xD8;
@@ -466,4 +499,9 @@ bool wxJPEGHandler::DoCanRead( wxInputStream& stream )
 
 #endif   // wxUSE_STREAMS
 
+/*static*/ wxVersionInfo wxJPEGHandler::GetLibraryVersionInfo()
+{
+    return wxVersionInfo("libjpeg", JPEG_LIB_VERSION/10, JPEG_LIB_VERSION%10);
+}
+
 #endif   // wxUSE_LIBJPEG