diff --git a/src/ImageSharp/Formats/Jpeg/Components/ZigZag.cs b/src/ImageSharp/Formats/Jpeg/Components/ZigZag.cs
index 250e98c02c..059e2052b3 100644
--- a/src/ImageSharp/Formats/Jpeg/Components/ZigZag.cs
+++ b/src/ImageSharp/Formats/Jpeg/Components/ZigZag.cs
@@ -17,17 +17,6 @@ namespace SixLabors.ImageSharp.Formats.Jpeg.Components
internal unsafe struct ZigZag
{
///
- /// Copy of in a value type
- ///
- public fixed byte Data[64 + 16];
-
- ///
- ///
- /// Unzig maps from the zigzag ordering to the natural ordering. For example,
- /// unzig[3] is the column and row of the fourth element in zigzag order. The
- /// value is 16, which means first column (16%8 == 0) and third row (16/8 == 2).
- ///
- ///
/// When reading corrupted data, the Huffman decoders could attempt
/// to reference an entry beyond the end of this array (if the decoded
/// zero run length reaches past the end of the block). To prevent
@@ -36,9 +25,21 @@ namespace SixLabors.ImageSharp.Formats.Jpeg.Components
/// to be stored in location 63 of the block, not somewhere random.
/// The worst case would be a run-length of 15, which means we need 16
/// fake entries.
- ///
+ ///
+ private const int Size = 64 + 16;
+
+ ///
+ /// Copy of in a value type
+ ///
+ public fixed byte Data[Size];
+
+ ///
+ /// Unzig maps from the zigzag ordering to the natural ordering. For example,
+ /// unzig[3] is the column and row of the fourth element in zigzag order. The
+ /// value is 16, which means first column (16%8 == 0) and third row (16/8 == 2).
///
private static readonly byte[] Unzig =
+ new byte[Size]
{
0, 1, 8, 16, 9, 2, 3, 10,
17, 24, 32, 25, 18, 11, 4, 5,
@@ -75,7 +76,7 @@ namespace SixLabors.ImageSharp.Formats.Jpeg.Components
{
ZigZag result = default;
byte* unzigPtr = result.Data;
- Marshal.Copy(Unzig, 0, (IntPtr)unzigPtr, 64 + 16);
+ Marshal.Copy(Unzig, 0, (IntPtr)unzigPtr, Size);
return result;
}
@@ -86,7 +87,7 @@ namespace SixLabors.ImageSharp.Formats.Jpeg.Components
{
Block8x8F result = default;
- for (int i = 0; i < 64; i++)
+ for (int i = 0; i < Block8x8F.Size; i++)
{
result[Unzig[i]] = qt[i];
}
diff --git a/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs b/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs
index 442fcb3d12..d428000efe 100644
--- a/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs
+++ b/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs
@@ -17,6 +17,7 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg
// BUG: The following image has a high difference compared to the expected output:
// TestImages.Jpeg.Baseline.Jpeg420Small,
+ // TestImages.Jpeg.Issues.Fuzz.AccessViolationException922,
TestImages.Jpeg.Baseline.Jpeg444,
TestImages.Jpeg.Baseline.Bad.BadEOF,
@@ -106,4 +107,4 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg
[TestImages.Jpeg.Progressive.Bad.ExifUndefType] = 0.011f / 100,
};
}
-}
\ No newline at end of file
+}
diff --git a/tests/ImageSharp.Tests/TestImages.cs b/tests/ImageSharp.Tests/TestImages.cs
index 62b7ae2ec0..d8e8719ba1 100644
--- a/tests/ImageSharp.Tests/TestImages.cs
+++ b/tests/ImageSharp.Tests/TestImages.cs
@@ -1,4 +1,4 @@
-// Copyright (c) Six Labors and contributors.
+// Copyright (c) Six Labors and contributors.
// Licensed under the Apache License, Version 2.0.
using System.Linq;
@@ -202,6 +202,7 @@ namespace SixLabors.ImageSharp.Tests
public const string ArgumentException826C = "Jpg/issues/fuzz/Issue826-ArgumentException-C.jpg";
public const string AccessViolationException827 = "Jpg/issues/fuzz/Issue827-AccessViolationException.jpg";
public const string ExecutionEngineException839 = "Jpg/issues/fuzz/Issue839-ExecutionEngineException.jpg";
+ public const string AccessViolationException922 = "Jpg/issues/fuzz/Issue922-AccessViolationException.jpg";
}
}
diff --git a/tests/Images/Input/Jpg/issues/fuzz/Issue922-AccessViolationException.jpg b/tests/Images/Input/Jpg/issues/fuzz/Issue922-AccessViolationException.jpg
new file mode 100644
index 0000000000..ef43dc2cfe
--- /dev/null
+++ b/tests/Images/Input/Jpg/issues/fuzz/Issue922-AccessViolationException.jpg
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:52fc6235c184f33d2c817d65f737e2dfe695615ebc79589d8d3d78f6a0af0469
+size 1768097