Skip to content

Commit dfd4c55

Browse files
committed
Only accept markers that starts with 0xFF and is not followed by 0xFF or 0x00.
1 parent c8e2525 commit dfd4c55

File tree

1 file changed

+16
-17
lines changed

1 file changed

+16
-17
lines changed

src/decoder.rs

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -333,23 +333,22 @@ impl<R: Read> Decoder<R> {
333333
}
334334

335335
fn read_marker(&mut self) -> Result<Marker> {
336-
// This should be an error as the JPEG spec doesn't allow extraneous data between marker segments.
337-
// libjpeg allows this though and there are images in the wild utilising it, so we are
338-
// forced to support this behavior.
339-
// Sony Ericsson P990i is an example of a device which produce this sort of JPEGs.
340-
while self.reader.read_u8()? != 0xFF {}
341-
342-
let mut byte = self.reader.read_u8()?;
343-
344-
// Section B.1.1.2
345-
// "Any marker may optionally be preceded by any number of fill bytes, which are bytes assigned code X’FF’."
346-
while byte == 0xFF {
347-
byte = self.reader.read_u8()?;
348-
}
349-
350-
match byte {
351-
0x00 => Err(Error::Format("FF 00 found where marker was expected".to_owned())),
352-
_ => Ok(Marker::from_u8(byte).unwrap()),
336+
loop {
337+
// This should be an error as the JPEG spec doesn't allow extraneous data between marker segments.
338+
// libjpeg allows this though and there are images in the wild utilising it, so we are
339+
// forced to support this behavior.
340+
// Sony Ericsson P990i is an example of a device which produce this sort of JPEGs.
341+
while self.reader.read_u8()? != 0xFF {}
342+
343+
// Section B.1.1.2
344+
// All markers are assigned two-byte codes: an X’FF’ byte followed by a
345+
// byte which is not equal to 0 or X’FF’ (see Table B.1). Any marker may
346+
// optionally be preceded by any number of fill bytes, which are bytes
347+
// assigned code X’FF’.
348+
let byte = self.reader.read_u8()?;
349+
if byte != 0x00 && byte != 0xFF {
350+
return Ok(Marker::from_u8(byte).unwrap());
351+
}
353352
}
354353
}
355354

0 commit comments

Comments
 (0)