Merge branch 'master' into dev
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 29473ab..75297e1 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1016,7 +1016,8 @@
DEPENDS djpeg-${libtype}-rgb-islow)
add_bittest(jpegtran icc "-copy;all;-icc;${TESTIMAGES}/test2.icc"
- testout_rgb_islow2.jpg testout_rgb_islow.jpg ${MD5_JPEG_RGB_ISLOW2})
+ testout_rgb_islow2.jpg testout_rgb_islow.jpg
+ ${MD5_JPEG_RGB_ISLOW2} cjpeg-${libtype}-rgb-islow)
if(NOT WITH_12BIT)
# CC: RGB->RGB565 SAMP: fullsize IDCT: islow ENT: huff
diff --git a/ChangeLog.md b/ChangeLog.md
index a0cba6c..58d78a2 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -92,6 +92,12 @@
source image is associated with this instance") when attempting to use that
method to compress a YUV image.
+3. Fixed an issue in the PPM reader that caused a buffer overrun in cjpeg,
+TJBench, or the `tjLoadImage()` function if one of the values in a binary
+PPM/PGM input file exceeded the maximum value defined in the file's header and
+that maximum value was less than 255. libjpeg-turbo 1.5.0 already included a
+similar fix for binary PPM/PGM files with maximum values greater than 255.
+
2.0.4
=====
@@ -657,10 +663,10 @@
3. Fixed a couple of issues in the PPM reader that would cause buffer overruns
in cjpeg if one of the values in a binary PPM/PGM input file exceeded the
-maximum value defined in the file's header. libjpeg-turbo 1.4.2 already
-included a similar fix for ASCII PPM/PGM files. Note that these issues were
-not security bugs, since they were confined to the cjpeg program and did not
-affect any of the libjpeg-turbo libraries.
+maximum value defined in the file's header and that maximum value was greater
+than 255. libjpeg-turbo 1.4.2 already included a similar fix for ASCII PPM/PGM
+files. Note that these issues were not security bugs, since they were confined
+to the cjpeg program and did not affect any of the libjpeg-turbo libraries.
4. Fixed an issue whereby attempting to decompress a JPEG file with a corrupt
header using the `tjDecompressToYUV2()` function would cause the function to
diff --git a/rdppm.c b/rdppm.c
index 71a7eb9..508c8c4 100644
--- a/rdppm.c
+++ b/rdppm.c
@@ -5,7 +5,7 @@
* Copyright (C) 1991-1997, Thomas G. Lane.
* Modified 2009 by Bill Allombert, Guido Vollbeding.
* libjpeg-turbo Modifications:
- * Copyright (C) 2015-2017, D. R. Commander.
+ * Copyright (C) 2015-2017, 2020, D. R. Commander.
* For conditions of distribution and use, see the accompanying README.ijg
* file.
*
@@ -710,7 +710,7 @@
/* On 16-bit-int machines we have to be careful of maxval = 65535 */
source->rescale = (JSAMPLE *)
(*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
- (size_t)(((long)maxval + 1L) *
+ (size_t)(((long)MAX(maxval, 255) + 1L) *
sizeof(JSAMPLE)));
half_maxval = maxval / 2;
for (val = 0; val <= (long)maxval; val++) {
