[Gnash-commit] /srv/bzr/gnash/trunk r9740: Fix for bug #24265 (crash loading malformed jpeg).

[Benjamin Wolsey]

------------------------------------------------------------
revno: 9740
committer: Benjamin Wolsey <address@hidden>
branch nick: trunk
timestamp: Mon 2008-09-15 11:05:23 +0200
message:
  Fix for bug #24265 (crash loading malformed jpeg).
modified:
  libbase/GnashImageJpeg.cpp
  libbase/image.cpp

=== modified file 'libbase/GnashImageJpeg.cpp'
--- a/libbase/GnashImageJpeg.cpp        2008-08-18 23:53:04 +0000
+++ b/libbase/GnashImageJpeg.cpp        2008-09-15 09:05:23 +0000
@@ -325,7 +325,7 @@
 void
 JpegImageInput::startImage()
 {
-       assert(_compressorOpened == false);
+       assert(!_compressorOpened);
 
        if ( setjmp(_jmpBuf) )
        {
@@ -386,6 +386,13 @@
 void
 JpegImageInput::finishImage()
 {
+       if ( setjmp(_jmpBuf) )
+       {
+               std::stringstream ss;
+               ss << "Internal jpeg error: " << _errorOccurred;
+               throw gnash::ParserException(ss.str());
+       }
+
        if (_compressorOpened)
        {
                jpeg_finish_decompress(&m_cinfo);
@@ -424,6 +431,7 @@
 JpegImageInput::readScanline(unsigned char* rgb_data)
 {
        assert(_compressorOpened);
+
        assert(m_cinfo.output_scanline < m_cinfo.output_height);
        int     lines_read = jpeg_read_scanlines(&m_cinfo, &rgb_data, 1);
        assert(lines_read == 1);

=== modified file 'libbase/image.cpp'
--- a/libbase/image.cpp 2008-09-01 13:09:28 +0000
+++ b/libbase/image.cpp 2008-09-15 09:05:23 +0000
@@ -242,19 +242,25 @@
         
         const size_t height = inChannel->getHeight();
         const size_t width = inChannel->getWidth();
-        
-        switch (inChannel->imageType())
-        {
-            case GNASH_IMAGE_RGB:
-                im.reset(new image::ImageRGB(width, height));
-                break;
-            case GNASH_IMAGE_RGBA:
-                im.reset(new image::ImageRGBA(width, height));
-                break;
-            default:
-                log_error("Invalid image returned");
-                im.reset(NULL);
-                return im;
+
+        try
+        {
+            switch (inChannel->imageType())
+            {
+                case GNASH_IMAGE_RGB:
+                    im.reset(new image::ImageRGB(width, height));
+                    break;
+                case GNASH_IMAGE_RGBA:
+                    im.reset(new image::ImageRGBA(width, height));
+                    break;
+                default:
+                    log_error("Invalid image returned");
+                    return im;
+            }
+        }
+        catch (std::bad_alloc& e)
+        {
+            return im;        
         }
         
         for (size_t i = 0; i < height; ++i)