3 people 02057eddec dng: bound lossless-JPEG decoding by the data it has and reject shared tile bytes (#3680) ...

* dng: bound lossless-JPEG decoding by the data it has and reject shared tile bytes (#2776)

Remaining amplification holes after the decoded-sample cap: the per-chunk
decode cap had 256 Ki samples of slack on top of the chunk's size, a patched
frame header could ask for far more samples than the entropy-coded bytes can
hold (zero bits were fed past the end), and strips/tiles pointing at the same
bytes were each decoded in full.

ljpeg::decode now fails with Truncated when width*height*components needs more
than one bit per sample of the remaining data, the caller caps at exactly the
chunk's sample count, and raw::chunks rejects overlapping strip/tile ranges.

Tested with a tiny lj92 stream whose SOF is patched to 512x512 and a tiled
file whose second tile reuses the first tile's bytes.

Fixes #2776

* dng: keep the slack for a lossless JPEG coded larger than its chunk

The entropy-length bound already caps the allocation; a last strip coded at
full RowsPerStrip holds more samples than the chunk needs and is truncated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 15:15:44 -05:00

..

main.rs

CI: xtask ci in the dev profile, one test binary per crate, nextest (#2860)

2026-10-23 13:34:16 -04:00

oracle_libraw.rs

CI: xtask ci in the dev profile, one test binary per crate, nextest (#2860)

2026-10-23 13:34:16 -04:00

roundtrip.rs

dng: bound lossless-JPEG decoding by the data it has and reject shared tile bytes (#3680)

2026-11-01 15:15:44 -05:00