diff --git a/src/file_jpg.c b/src/file_jpg.c index 0f898118..a2d2308f 100644 --- a/src/file_jpg.c +++ b/src/file_jpg.c @@ -928,8 +928,9 @@ static void jpg_check_picture(file_recovery_t *file_recovery) } else { - jpeg_session.frame = (unsigned char *)MALLOC(jpeg_session.output_height * jpeg_session.row_stride); - memset(jpeg_session.frame, 0x80, jpeg_session.row_stride * jpeg_session.cinfo.output_height); + /* FIXME out of bound read access in libjpeg-turbo */ + jpeg_session.frame = (unsigned char *)MALLOC((jpeg_session.output_height+1) * jpeg_session.row_stride); + memset(jpeg_session.frame, 0x80, (jpeg_session.cinfo.output_height+1) * jpeg_session.row_stride); } while (jpeg_session.cinfo.output_scanline < jpeg_session.cinfo.output_height) { diff --git a/src/suspend.c b/src/suspend.c index 5bc6d0a0..60cfdbba 100644 --- a/src/suspend.c +++ b/src/suspend.c @@ -2,6 +2,7 @@ File: suspend.c A suspending/resuming memory manager for libjpeg + NOT COMPATIBLE WITH libjpeg-turbo Copyright (C) 2009 Christophe GRENIER Copyright (C) 2008 Michael Cohen , part of pyflag