Kaydet (Commit) d433bb87 authored tarafından Caolán McNamara's avatar Caolán McNamara

sync with final upstream commit

Change-Id: I7ebe6096a63f1da29523295b8065c998809e125a
üst cffc082e
From 066fee2e7d6834f24838bc1896aa38ca77209e3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Thu, 16 Mar 2017 15:53:53 +0000
Subject: [PATCH] honor max_memory_to_use if its set
From da2a27ef056a0179cbd80f9146e58b89403d9933 Mon Sep 17 00:00:00 2001
From: DRC <information@libjpeg-turbo.org>
Date: Sat, 18 Mar 2017 16:15:14 -0500
Subject: [PATCH] Honor max_memory_to_use/JPEGMEM/-maxmemory
I'd like to use JPEGMEM to limit memory that libjpeg will allocation
to reject sizes that would the default 2G limit under asan while
fuzzing LibreOffice's jpeg integration
This re-introduces a feature of the obsolete system-specific libjpeg
memory managers-- namely the ability to limit the amount of main memory
used by the library during decompression or multi-pass compression.
This is mainly beneficial for two reasons:
- Works around a 2 GB limit in libFuzzer
- Allows security-sensitive applications to set a memory limit for the
JPEG decoder so as to work around the progressive JPEG exploit
(LJT-01-004) described here:
http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
This commit also removes obsolete documentation regarding the MS-DOS
memory manager (which itself was removed long ago) and changes the
documentation of the -maxmemory switch and JPEGMEM environment variable
to reflect the fact that backing stores are never used in libjpeg-turbo.
Inspired by:
https://github.com/caolanm/libjpeg-turbo/commit/066fee2e7d6834f24838bc1896aa38ca77209e3c
Closes #143
---
jmemnobs.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
ChangeLog.md | 15 +++++++++++++++
cjpeg.1 | 4 ++--
djpeg.1 | 4 ++--
jmemnobs.c | 16 +++++++++++-----
jpegtran.1 | 4 ++--
libjpeg.txt | 14 ++++++--------
structure.txt | 24 +++++++++++-------------
usage.txt | 35 +++++------------------------------
8 files changed, 54 insertions(+), 62 deletions(-)
diff --git a/jmemnobs.c b/jmemnobs.c
index 5797198..c7dc560 100644
index 5797198..ac12afa 100644
--- a/jmemnobs.c
+++ b/jmemnobs.c
@@ -66,14 +66,24 @@ jpeg_free_large (j_common_ptr cinfo, void *object, size_t sizeofobject)
@@ -3,8 +3,8 @@
*
* This file was part of the Independent JPEG Group's software:
* Copyright (C) 1992-1996, Thomas G. Lane.
- * It was modified by The libjpeg-turbo Project to include only code and
- * information relevant to libjpeg-turbo.
+ * libjpeg-turbo Modifications:
+ * Copyright (C) 2017, D. R. Commander.
* For conditions of distribution and use, see the accompanying README.ijg
* file.
*
@@ -15,7 +15,6 @@
* This is very portable in the sense that it'll compile on almost anything,
* but you'd better have lots of main memory (or virtual memory) if you want
* to process big images.
- * Note that the max_memory_to_use option is ignored by this implementation.
*/
#define JPEG_INTERNALS
@@ -66,14 +65,21 @@ jpeg_free_large (j_common_ptr cinfo, void *object, size_t sizeofobject)
/*
* This routine computes the total memory space available for allocation.
......@@ -26,21 +69,15 @@ index 5797198..c7dc560 100644
size_t max_bytes_needed, size_t already_allocated)
{
- return max_bytes_needed;
+ if (!cinfo->mem->max_memory_to_use)
+ {
+ if (cinfo->mem->max_memory_to_use) {
+ if (cinfo->mem->max_memory_to_use > already_allocated)
+ return cinfo->mem->max_memory_to_use - already_allocated;
+ else
+ return 0;
+ } else {
+ /* Here we always say, "we got all you want bud!" */
+ return max_bytes_needed;
+ }
+
+ if (cinfo->mem->max_memory_to_use - already_allocated >= max_bytes_needed)
+ {
+ return max_bytes_needed;
+ }
+
+ return cinfo->mem->max_memory_to_use - already_allocated;
}
--
2.9.3
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment