| commit | 2838bec41351d0eab9cc5a2c784da33e16b0aac7 | [log] [tgz] |
|---|---|---|
| author | Ram Mohan <ram.mohan@ittiam.com> | Fri May 19 02:46:49 2023 +0530 |
| committer | Dichen Zhang <dichenzhang@google.com> | Tue May 23 17:08:57 2023 +0000 |
| tree | 754064ffa321d219ac5ed3926eaa1a56e4410676 | |
| parent | 1dd15d0d52d6975a01cbc5cc3359c9747df5717f [diff] |
ultrahdr: decompress image writes outside bounds for non aligned widths jpeg_read_raw_data() returns one MCU row per call, and thus one must pass buffer of at least max_v_samp_factor * DCTSIZE scanlines. The buffer must be large enough to hold the actual data plus padding to DCT-block boundaries. Bug: 283500706 Test: ./ultrahdr_enc_fuzzer Change-Id: Icb7c7e3eda590efc05d5945e7c906c1e4a012eab