diff --git a/src/ImageSharp/Formats/Jpeg/Components/Decoder/JpegComponent.cs b/src/ImageSharp/Formats/Jpeg/Components/Decoder/JpegComponent.cs index 535330394..9fa4ce6d8 100644 --- a/src/ImageSharp/Formats/Jpeg/Components/Decoder/JpegComponent.cs +++ b/src/ImageSharp/Formats/Jpeg/Components/Decoder/JpegComponent.cs @@ -1,4 +1,4 @@ -// Copyright (c) Six Labors and contributors. +// Copyright (c) Six Labors and contributors. // Licensed under the Apache License, Version 2.0. using System; @@ -22,11 +22,8 @@ namespace SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder this.Frame = frame; this.Id = id; - // Valid sampling factors are 1..2 - if (horizontalFactor == 0 - || verticalFactor == 0 - || horizontalFactor > 2 - || verticalFactor > 2) + // Validate sampling factors. + if (horizontalFactor == 0 || verticalFactor == 0) { JpegThrowHelper.ThrowBadSampling(); } @@ -138,4 +135,4 @@ namespace SixLabors.ImageSharp.Formats.Jpeg.Components.Decoder this.SpectralBlocks = this.memoryAllocator.Allocate2D(width, height, AllocationOptions.Clean); } } -} \ No newline at end of file +} diff --git a/src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs b/src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs index ec9cca8c8..62765a884 100644 --- a/src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs +++ b/src/ImageSharp/Formats/Jpeg/JpegDecoderCore.cs @@ -764,7 +764,7 @@ namespace SixLabors.ImageSharp.Formats.Jpeg for (int i = 0; i < this.ComponentCount; i++) { byte hv = this.temp[index + 1]; - int h = hv >> 4; + int h = (hv >> 4) & 15; int v = hv & 15; if (maxH < h) diff --git a/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs b/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs index 4a3ef9b95..37da32d76 100644 --- a/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs +++ b/tests/ImageSharp.Tests/Formats/Jpg/JpegDecoderTests.Images.cs @@ -31,6 +31,7 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg TestImages.Jpeg.Issues.InvalidAPP0721, TestImages.Jpeg.Issues.ExifGetString750Load, TestImages.Jpeg.Issues.ExifGetString750Transform, + TestImages.Jpeg.Issues.BadSubSampling1076, // LibJpeg can open this despite the invalid density units. TestImages.Jpeg.Issues.Fuzz.ArgumentOutOfRangeException825B, @@ -38,6 +39,9 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg // LibJpeg can open this despite incorrect colorspace metadata. TestImages.Jpeg.Issues.IncorrectColorspace855, + // LibJpeg can open this despite the invalid subsampling units. + TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C, + // High depth images TestImages.Jpeg.Baseline.Testorig12bit, }; @@ -71,7 +75,6 @@ namespace SixLabors.ImageSharp.Tests.Formats.Jpg TestImages.Jpeg.Issues.Fuzz.NullReferenceException823, TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824A, TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824B, - TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824C, TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824D, TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824E, TestImages.Jpeg.Issues.Fuzz.IndexOutOfRangeException824F, diff --git a/tests/ImageSharp.Tests/TestImages.cs b/tests/ImageSharp.Tests/TestImages.cs index ada077496..f5cdb29b6 100644 --- a/tests/ImageSharp.Tests/TestImages.cs +++ b/tests/ImageSharp.Tests/TestImages.cs @@ -192,6 +192,7 @@ namespace SixLabors.ImageSharp.Tests public const string IncorrectColorspace855 = "Jpg/issues/issue855-incorrect-colorspace.jpg"; public const string IncorrectResize1006 = "Jpg/issues/issue1006-incorrect-resize.jpg"; public const string ExifResize1049 = "Jpg/issues/issue1049-exif-resize.jpg"; + public const string BadSubSampling1076 = "Jpg/issues/issue-1076-invalid-subsampling.jpg"; public static class Fuzz { diff --git a/tests/Images/External b/tests/Images/External index d8ea82085..b47190bd5 160000 --- a/tests/Images/External +++ b/tests/Images/External @@ -1 +1 @@ -Subproject commit d8ea82085ac39a6aa6ca8e0806a9518d3a7d3337 +Subproject commit b47190bd5cd450110f3849962512b918d2596ecf diff --git a/tests/Images/Input/Jpg/issues/issue-1076-invalid-subsampling.jpg b/tests/Images/Input/Jpg/issues/issue-1076-invalid-subsampling.jpg new file mode 100644 index 000000000..6cc3531a0 --- /dev/null +++ b/tests/Images/Input/Jpg/issues/issue-1076-invalid-subsampling.jpg @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:1507746a6c37697cb985fc7427709fd68478ff7cbdfe20f6cfbe7257ed6c7ccd +size 39149