tree 56a1f82d5e4e6ee09ed65bada521fbe74b39f8af
parent 65ce1459b6ad63b67b4804c4d326da5b51ef24c5
author DRC <information@libjpeg-turbo.org> 1637682863 -0600
committer DRC <information@libjpeg-turbo.org> 1637686812 -0600

jdarith.c: Require cinfo->Se == DCTSIZE2 - 1

This fixes an oversight from the integration of the arithmetic entropy
codec from libjpeg (66f97e6820e2cc9ef7429ea36285c80ffda87c8f).  I chose
to integrate the latest implementation available at the time, which was
from jpeg-8b.  However, I naively replaced cinfo->lim_Se with
DCTSIZE2 - 1, not realizing that-- because of SmartScale-- jpeg-8b
contains additional code
(https://github.com/libjpeg-turbo/libjpeg-turbo/blob/jpeg-8b/jdinput.c#L249-L334)
that guards against illegal values of cinfo->Se >= DCTSIZE2.  Thus,
libjpeg-turbo's implementation of arithmetic decoding has never guarded
against such illegal values.  This commit restores the relevant check
from the original jpeg-6b arithmetic entropy codec patch ("jpeg-ari",
1e247ac854f8e33682bcfea475f6bccc42377208).

Fixes #564