tree 3ce21ad98ba7c1c81d73db512e0f4ad8310e517e
parent 171b875b272f47f1ae42a5009c64f424db22a95b
author DRC <information@libjpeg-turbo.org> 1618543613 -0500
committer DRC <information@libjpeg-turbo.org> 1618545350 -0500

Huff dec: Fix non-deterministic output w/bad input

Referring to https://bugzilla.mozilla.org/show_bug.cgi?id=1050342,
there are certain very rare circumstances under which a malformed JPEG
image can cause different Huffman decoder output to be produced,
depending on the size of the source manager's I/O buffer.  (More
specifically, the fast Huffman decoder didn't handle invalid codes in
the same manner as the slow decoder, and since the fast decoder requires
all data to be memory-resident, the buffering strategy determines
whether or not the fast decoder can be used on a particular MCU block.)

After extensive experimentation, the Mozilla and Chrome developers and I
determined that this truly was an innocuous issue.  The patch that both
browsers adopted as a workaround caused a performance regression with
32-bit code, which is why it was not accepted into libjpeg-turbo.  This
commit fixes the problem in a less disruptive way with no performance
regression.