@@ -228,16 +228,17 @@ public void LoadTables(byte[] tableBytes, HuffmanScanDecoder huffmanScanDecoder)
228228 this . Metadata = new ImageMetadata ( ) ;
229229 this . QuantizationTables = new Block8x8F [ 4 ] ;
230230 this . scanDecoder = huffmanScanDecoder ;
231+
232+ if ( tableBytes . Length < 4 )
233+ {
234+ JpegThrowHelper . ThrowInvalidImageContentException ( "Not enough data to read marker" ) ;
235+ }
236+
231237 using var ms = new MemoryStream ( tableBytes ) ;
232238 using var stream = new BufferedReadStream ( this . Configuration , ms ) ;
233239
234240 // Check for the Start Of Image marker.
235241 int bytesRead = stream . Read ( this . markerBuffer , 0 , 2 ) ;
236- if ( bytesRead != 2 )
237- {
238- JpegThrowHelper . ThrowInvalidImageContentException ( "Not enough data to read the SOI marker" ) ;
239- }
240-
241242 var fileMarker = new JpegFileMarker ( this . markerBuffer [ 1 ] , 0 ) ;
242243 if ( fileMarker . Marker != JpegConstants . Markers . SOI )
243244 {
@@ -246,20 +247,22 @@ public void LoadTables(byte[] tableBytes, HuffmanScanDecoder huffmanScanDecoder)
246247
247248 // Read next marker.
248249 bytesRead = stream . Read ( this . markerBuffer , 0 , 2 ) ;
249- if ( bytesRead != 2 )
250- {
251- JpegThrowHelper . ThrowInvalidImageContentException ( "Not enough data to read marker" ) ;
252- }
253-
254- byte marker = this . markerBuffer [ 1 ] ;
255- fileMarker = new JpegFileMarker ( marker , ( int ) stream . Position - 2 ) ;
250+ fileMarker = new JpegFileMarker ( this . markerBuffer [ 1 ] , ( int ) stream . Position - 2 ) ;
256251
257252 while ( fileMarker . Marker != JpegConstants . Markers . EOI || ( fileMarker . Marker == JpegConstants . Markers . EOI && fileMarker . Invalid ) )
258253 {
259254 if ( ! fileMarker . Invalid )
260255 {
261256 // Get the marker length.
262- int remaining = this . ReadUint16 ( stream ) - 2 ;
257+ int markerContentByteSize = this . ReadUint16 ( stream ) - 2 ;
258+
259+ // Check whether stream actually has enought bytes to read
260+ // markerContentByteSize is always positive so we cast
261+ // to uint to avoid sign extension
262+ if ( stream . RemainingBytes < ( uint ) markerContentByteSize )
263+ {
264+ JpegThrowHelper . ThrowNotEnoughBytesForMarker ( fileMarker . Marker ) ;
265+ }
263266
264267 switch ( fileMarker . Marker )
265268 {
@@ -269,13 +272,13 @@ public void LoadTables(byte[] tableBytes, HuffmanScanDecoder huffmanScanDecoder)
269272 case JpegConstants . Markers . RST7 :
270273 break ;
271274 case JpegConstants . Markers . DHT :
272- this . ProcessDefineHuffmanTablesMarker ( stream , remaining ) ;
275+ this . ProcessDefineHuffmanTablesMarker ( stream , markerContentByteSize ) ;
273276 break ;
274277 case JpegConstants . Markers . DQT :
275- this . ProcessDefineQuantizationTablesMarker ( stream , remaining ) ;
278+ this . ProcessDefineQuantizationTablesMarker ( stream , markerContentByteSize ) ;
276279 break ;
277280 case JpegConstants . Markers . DRI :
278- this . ProcessDefineRestartIntervalMarker ( stream , remaining ) ;
281+ this . ProcessDefineRestartIntervalMarker ( stream , markerContentByteSize ) ;
279282 break ;
280283 case JpegConstants . Markers . EOI :
281284 return ;
0 commit comments