Lint progressive scan details. Touch #824

SixLabors · Feb 16, 2019 · 8d974c5 · 8d974c5
1 parent 9efdcb6
commit 8d974c5
Show file tree

Hide file tree

Showing 6 changed files with 59 additions and 9 deletions.
diff --git a/src/ImageSharp/Formats/Jpeg/Components/Decoder/ScanDecoder.cs b/src/ImageSharp/Formats/Jpeg/Components/Decoder/ScanDecoder.cs
@@ -270,8 +270,60 @@ private void ParseBaselineDataNonInterleaved()
             }
         }
 
+        private void CheckProgressiveData()
+        {
+            // Validate successive scan parameters.
+            // Logic has been adapted from libjpeg.
+            // See Table B.3 – Scan header parameter size and values. itu-t81.pdf
+            bool invalid = false;
+            if (this.spectralStart == 0)
+            {
+                if (this.spectralEnd != 0)
+                {
+                    invalid = true;
+                }
+            }
+            else
+            {
+                // Need not check Ss/Se < 0 since they came from unsigned bytes.
+                if (this.spectralEnd < this.spectralStart || this.spectralEnd > 63)
+                {
+                    invalid = true;
+                }
+
+                // AC scans may have only one component.
+                if (this.componentsLength != 1)
+                {
+                    invalid = true;
+                }
+            }
+
+            if (this.successiveHigh != 0)
+            {
+                // Successive approximation refinement scan: must have Al = Ah-1.
+                if (this.successiveHigh - 1 != this.successiveLow)
+                {
+                    invalid = true;
+                }
+            }
+
+            // TODO: How does this affect 12bit jpegs.
+            // According to libjpeg the range covers 8bit only?
+            if (this.successiveLow > 13)
+            {
+                invalid = true;
+            }
+
+            if (invalid)
+            {
+                JpegThrowHelper.ThrowBadProgressiveScan(this.spectralStart, this.spectralEnd, this.successiveHigh, this.successiveLow);
+            }
+        }
+
         private void ParseProgressiveData()
         {
+            this.CheckProgressiveData();
+
             if (this.componentsLength == 1)
             {
                 this.ParseProgressiveDataNonInterleaved();

diff --git a/src/ImageSharp/Formats/Jpeg/JpegThrowHelper.cs b/src/ImageSharp/Formats/Jpeg/JpegThrowHelper.cs
@@ -26,6 +26,9 @@ internal static class JpegThrowHelper
         [MethodImpl(InliningOptions.ColdPath)]
         public static void ThrowBadSampling() => throw new ImageFormatException("Bad sampling factor.");
 
+        [MethodImpl(InliningOptions.ColdPath)]
+        public static void ThrowBadProgressiveScan(int ss, int se, int ah, int al) => throw new ImageFormatException($"Invalid progressive parameters Ss={ss} Se={se} Ah={ah} Al={al}.");
+
         [MethodImpl(InliningOptions.ColdPath)]
         public static void ThrowInvalidImageDimensions(int width, int height) => throw new ImageFormatException($"Invalid image dimensions: {width}x{height}.");
     }

diff --git a/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Baseline.cs b/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Baseline.cs
@@ -1,7 +1,6 @@
 // Copyright (c) Six Labors and contributors.
 // Licensed under the Apache License, Version 2.0.
 
-using System;
 
 using SixLabors.ImageSharp.PixelFormats;
 using Xunit;
@@ -38,11 +37,5 @@ public void DecodeBaselineJpeg<TPixel>(TestImageProvider<TPixel> provider)
         [WithFileCollection(nameof(UnrecoverableTestJpegs), PixelTypes.Rgba32)]
         public void UnrecoverableImagesShouldThrowCorrectError<TPixel>(TestImageProvider<TPixel> provider)
             where TPixel : struct, IPixel<TPixel> => Assert.Throws<ImageFormatException>(() => provider.GetImage());
-
-        // TODO: This should actually throw.
-        [Theory]
-        [WithFile(TestImages.Jpeg.Issues.Fuzz.AccessViolationException798, PixelTypes.Rgba32)]
-        public void LoadingImage_BadHuffman_ShouldNotThrow<TPixel>(TestImageProvider<TPixel> provider)
-            where TPixel : struct, IPixel<TPixel> => Assert.NotNull(provider.GetImage());
     }
 }
diff --git a/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs b/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs
@@ -58,7 +58,7 @@ public partial class JpegDecoderTests
 
             TestImages.Jpeg.Issues.CriticalEOF214,
             TestImages.Jpeg.Issues.Fuzz.NullReferenceException797,
-            // TestImages.Jpeg.Issues.Fuzz.AccessViolationException798,
+            TestImages.Jpeg.Issues.Fuzz.AccessViolationException798,
             TestImages.Jpeg.Issues.Fuzz.DivideByZeroException821,
             TestImages.Jpeg.Issues.Fuzz.DivideByZeroException822,
             TestImages.Jpeg.Issues.Fuzz.NullReferenceException823,
@@ -67,7 +67,8 @@ public partial class JpegDecoderTests
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C,
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824D,
             TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824E,
-            TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824F
+            TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824F,
+            TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824G
         };
 
         private static readonly Dictionary<string, float> CustomToleranceValues =

diff --git a/tests/ImageSharp.Tests/TestImages.cs b/tests/ImageSharp.Tests/TestImages.cs
@@ -186,6 +186,7 @@ public static class Fuzz
                     public const string IndexOutOfRangeException824D = "Jpg/issues/fuzz/Issue824-IndexOutOfRangeException-D.jpg";
                     public const string IndexOutOfRangeException824E = "Jpg/issues/fuzz/Issue824-IndexOutOfRangeException-E.jpg";
                     public const string IndexOutOfRangeException824F = "Jpg/issues/fuzz/Issue824-IndexOutOfRangeException-F.jpg";
+                    public const string IndexOutOfRangeException824G = "Jpg/issues/fuzz/Issue824-IndexOutOfRangeException-G.jpg";
                 }
             }
 

diff --git a/tests/Images/Input/Jpg/issues/fuzz/Issue824-IndexOutOfRangeException-G.jpg b/tests/Images/Input/Jpg/issues/fuzz/Issue824-IndexOutOfRangeException-G.jpg