image/jpeg: reject bad Tq values in SOF data.

Fixes golang#10154 Change-Id: Ibb8ea9bcf512e7639c57a6f17afbe4495fa329cd Reviewed-on: https://go-review.googlesource.com/7494 Reviewed-by: Minux Ma <[email protected]>
tbmvp · Mar 13, 2015 · 3eb84c8 · 3eb84c8
1 parent f076ad8
commit 3eb84c8
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/image/jpeg/reader.go b/src/image/jpeg/reader.go
@@ -331,6 +331,10 @@ func (d *decoder) processSOF(n int) error {
 		}
 
 		d.comp[i].tq = d.tmp[8+3*i]
+		if d.comp[i].tq > maxTq {
+			return FormatError("bad Tq value")
+		}
+
 		hv := d.tmp[7+3*i]
 		h, v := int(hv>>4), int(hv&0x0f)
 		if h < 1 || 4 < h || v < 1 || 4 < v {