commit 2a0b4ac3372c4dbe1c710ef2d9f15b96c4c9166f
author DRC <information@libjpeg-turbo.org> Tue Jul 21 16:43:39 2015 -0500
committer DRC <information@libjpeg-turbo.org> Wed Jul 29 17:19:15 2015 -0500
tree 3e9d2c4cc7718a34de2a05956c38bbb864d0b007
parent 9993410e445c368e1b8ab003273dca9aa4f6f5fe
parent 944aa8e3c4ea827c57d7bb9125f39611eb67ede1

Fix rare bug: right shift by a negative # of bits
Under very rare circumstances, decompressing specific corrupt JPEG
images would create a situation whereby GET_BITS(1) was invoked
from within HUFF_DECODE_FAST() when bits_left=0. This produced a right
shift by a negative number of bits, which is undefined in C.

jdhuff.c

diff --git a/jdhuff.c b/jdhuff.c
index b723c7e..b545e66 100644
--- a/jdhuff.c
+++ b/jdhuff.c
@@ -422,7 +422,7 @@
 
 /* Pre-fetch 48 bytes, because the holding register is 64-bit */
 #define FILL_BIT_BUFFER_FAST \
-  if (bits_left < 16) { \
+  if (bits_left <= 16) { \
     GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE GET_BYTE \
   }
 
@@ -430,7 +430,7 @@
 
 /* Pre-fetch 16 bytes, because the holding register is 32-bit */
 #define FILL_BIT_BUFFER_FAST \
-  if (bits_left < 16) { \
+  if (bits_left <= 16) { \
     GET_BYTE GET_BYTE \
   }