Skip to content

Commit 2ac18d8

Browse files
Optimize tiff/jpeg checks
1 parent c5f14f7 commit 2ac18d8

File tree

1 file changed

+19
-16
lines changed

1 file changed

+19
-16
lines changed

src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -228,16 +228,17 @@ public void LoadTables(byte[] tableBytes, HuffmanScanDecoder huffmanScanDecoder)
228228
this.Metadata = new ImageMetadata();
229229
this.QuantizationTables = new Block8x8F[4];
230230
this.scanDecoder = huffmanScanDecoder;
231+
232+
if (tableBytes.Length < 4)
233+
{
234+
JpegThrowHelper.ThrowInvalidImageContentException("Not enough data to read marker");
235+
}
236+
231237
using var ms = new MemoryStream(tableBytes);
232238
using var stream = new BufferedReadStream(this.Configuration, ms);
233239

234240
// Check for the Start Of Image marker.
235241
int bytesRead = stream.Read(this.markerBuffer, 0, 2);
236-
if (bytesRead != 2)
237-
{
238-
JpegThrowHelper.ThrowInvalidImageContentException("Not enough data to read the SOI marker");
239-
}
240-
241242
var fileMarker = new JpegFileMarker(this.markerBuffer[1], 0);
242243
if (fileMarker.Marker != JpegConstants.Markers.SOI)
243244
{
@@ -246,20 +247,22 @@ public void LoadTables(byte[] tableBytes, HuffmanScanDecoder huffmanScanDecoder)
246247

247248
// Read next marker.
248249
bytesRead = stream.Read(this.markerBuffer, 0, 2);
249-
if (bytesRead != 2)
250-
{
251-
JpegThrowHelper.ThrowInvalidImageContentException("Not enough data to read marker");
252-
}
253-
254-
byte marker = this.markerBuffer[1];
255-
fileMarker = new JpegFileMarker(marker, (int)stream.Position - 2);
250+
fileMarker = new JpegFileMarker(this.markerBuffer[1], (int)stream.Position - 2);
256251

257252
while (fileMarker.Marker != JpegConstants.Markers.EOI || (fileMarker.Marker == JpegConstants.Markers.EOI && fileMarker.Invalid))
258253
{
259254
if (!fileMarker.Invalid)
260255
{
261256
// Get the marker length.
262-
int remaining = this.ReadUint16(stream) - 2;
257+
int markerContentByteSize = this.ReadUint16(stream) - 2;
258+
259+
// Check whether stream actually has enought bytes to read
260+
// markerContentByteSize is always positive so we cast
261+
// to uint to avoid sign extension
262+
if (stream.RemainingBytes < (uint)markerContentByteSize)
263+
{
264+
JpegThrowHelper.ThrowNotEnoughBytesForMarker(fileMarker.Marker);
265+
}
263266

264267
switch (fileMarker.Marker)
265268
{
@@ -269,13 +272,13 @@ public void LoadTables(byte[] tableBytes, HuffmanScanDecoder huffmanScanDecoder)
269272
case JpegConstants.Markers.RST7:
270273
break;
271274
case JpegConstants.Markers.DHT:
272-
this.ProcessDefineHuffmanTablesMarker(stream, remaining);
275+
this.ProcessDefineHuffmanTablesMarker(stream, markerContentByteSize);
273276
break;
274277
case JpegConstants.Markers.DQT:
275-
this.ProcessDefineQuantizationTablesMarker(stream, remaining);
278+
this.ProcessDefineQuantizationTablesMarker(stream, markerContentByteSize);
276279
break;
277280
case JpegConstants.Markers.DRI:
278-
this.ProcessDefineRestartIntervalMarker(stream, remaining);
281+
this.ProcessDefineRestartIntervalMarker(stream, markerContentByteSize);
279282
break;
280283
case JpegConstants.Markers.EOI:
281284
return;

0 commit comments

Comments
 (0)