ultrahdr: decompress image writes outside bounds for non aligned widths
jpeg_read_raw_data() returns one MCU row per call, and thus one must pass buffer of at least max_v_samp_factor * DCTSIZE scanlines. The buffer must be large enough to hold the actual data plus padding to DCT-block boundaries. Bug: 283500706 Test: ./ultrahdr_enc_fuzzer Change-Id: Icb7c7e3eda590efc05d5945e7c906c1e4a012eab
Loading
Please register or sign in to comment