diff --git a/ChangeLog b/ChangeLog index c38bf213d..0efe3c5e2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2010-05-05 Peter Hurley (tiny change) + + * video/readers/jpeg.c (grub_jpeg_decode_huff_table): Loop over all + tables. Ignore non-last ac bit. + (grub_jpeg_decode_quan_table): Likewise. + 2010-05-05 Vladimir Serbinenko * include/grub/ieee1275/ieee1275.h (grub_ieee1275_flag): New value diff --git a/video/readers/jpeg.c b/video/readers/jpeg.c index 5e749b8fd..c82b30c9c 100644 --- a/video/readers/jpeg.c +++ b/video/readers/jpeg.c @@ -178,8 +178,10 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data) next_marker = data->file->offset; next_marker += grub_jpeg_get_word (data); + while (data->file->offset + sizeof (count) + 1 <= next_marker) + { id = grub_jpeg_get_byte (data); - ac = (id >> 4); + ac = (id >> 4) & 1; id &= 0xF; if (id > 1) return grub_error (GRUB_ERR_BAD_FILE_TYPE, @@ -213,6 +215,7 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data) base <<= 1; } + } if (data->file->offset != next_marker) grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in huffman table"); @@ -229,6 +232,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data) next_marker = data->file->offset; next_marker += grub_jpeg_get_word (data); + while (data->file->offset + sizeof (data->quan_table[id]) + 1 <= next_marker) + { id = grub_jpeg_get_byte (data); if (id >= 0x10) /* Upper 4-bit is precision. */ return grub_error (GRUB_ERR_BAD_FILE_TYPE, @@ -241,6 +246,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data) if (grub_file_read (data->file, &data->quan_table[id], 64) != 64) return grub_errno; + } + if (data->file->offset != next_marker) grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in quantization table");