ofz#53628 Use a progress monitor to avoid Timeout

LJT-01-003 of https://libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf

Change-Id: I834e0891c4bb91907750282a26b8b803f94b8fb0
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/143131
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 20 insertions, 0 deletions

diff --git a/vcl/source/filter/jpeg/jpegc.cxx b/vcl/source/filter/jpeg/jpegc.cxx
index 2b2f9713a695..a3ce069cccf7 100644
--- a/vcl/source/filter/jpeg/jpegc.cxx
+++ b/vcl/source/filter/jpeg/jpegc.cxx
@@ -150,6 +150,7 @@ private:
 struct JpegStuff
 {
     jpeg_decompress_struct cinfo;
+    jpeg_progress_mgr progress;
     ErrorManagerStruct jerr;
     JpegDecompressOwner aOwner;
     std::unique_ptr<BitmapScopedWriteAccess> pScopedAccess;
@@ -157,6 +158,23 @@ struct JpegStuff
     std::vector<sal_uInt8> pCYMKBuffer;
 };
 
+// https://github.com/libjpeg-turbo/libjpeg-turbo/issues/284
+// https://libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
+#define LIMITSCANS 100
+
+void progress_monitor(j_common_ptr cinfo)
+{
+    if (cinfo->is_decompressor)
+    {
+        jpeg_decompress_struct* decompressor = reinterpret_cast<j_decompress_ptr>(cinfo);
+        if (decompressor->input_scan_number >= LIMITSCANS)
+        {
+            SAL_WARN("vcl.filter", "too many progressive scans, cancelling import after: " << decompressor->input_scan_number << " scans");
+            errorExit(cinfo);
+        }
+    }
+}
+
 }
 
 static void ReadJPEG(JpegStuff& rContext, JPEGReader* pJPEGReader, void* pInputStream, tools::Long* pLines,
@@ -176,6 +194,8 @@ static void ReadJPEG(JpegStuff& rContext, JPEGReader* pJPEGReader, void* pInputS
     jpeg_create_decompress(&rContext.cinfo);
     rContext.aOwner.set(&rContext.cinfo);
     jpeg_svstream_src(&rContext.cinfo, pInputStream);
+    rContext.cinfo.progress = &rContext.progress;
+    rContext.progress.progress_monitor = progress_monitor;
     SourceManagerStruct *source = reinterpret_cast<SourceManagerStruct*>(rContext.cinfo.src);
     jpeg_read_header(&rContext.cinfo, TRUE);