* video/readers/jpeg.c (grub_jpeg_decode_huff_table): Loop over all

	tables. Ignore non-last ac bit.
	(grub_jpeg_decode_quan_table): Likewise.

diff --git a/ChangeLog b/ChangeLog
index c38bf213d34f5ff90b7a8fbddaa57c7041304ef3..0efe3c5e2da4f9e79847222febfe8cb4bfe9f31e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-05-05  Peter Hurley <No e-mail available> (tiny change)
+
+       * video/readers/jpeg.c (grub_jpeg_decode_huff_table): Loop over all
+       tables. Ignore non-last ac bit.
+       (grub_jpeg_decode_quan_table): Likewise.
+
 2010-05-05  Vladimir Serbinenko  <phcoder@gmail.com>
 
        * include/grub/ieee1275/ieee1275.h (grub_ieee1275_flag): New value

diff --git a/video/readers/jpeg.c b/video/readers/jpeg.c
index 5e749b8fd869c7e56fe3c6837ad1ad62b07f3ac0..c82b30c9c2d208135c77aa83fdf996dc5a191f6c 100644 (file)
--- a/video/readers/jpeg.c
+++ b/video/readers/jpeg.c
@@ -178,8 +178,10 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data)
   next_marker = data->file->offset;
   next_marker += grub_jpeg_get_word (data);
 
+  while (data->file->offset + sizeof (count) + 1 <= next_marker)
+    {
   id = grub_jpeg_get_byte (data);
-  ac = (id >> 4);
+      ac = (id >> 4) & 1;
   id &= 0xF;
   if (id > 1)
     return grub_error (GRUB_ERR_BAD_FILE_TYPE,
@@ -213,6 +215,7 @@ grub_jpeg_decode_huff_table (struct grub_jpeg_data *data)
 
       base <<= 1;
     }
+    }
 
   if (data->file->offset != next_marker)
     grub_error (GRUB_ERR_BAD_FILE_TYPE, "jpeg: extra byte in huffman table");
@@ -229,6 +232,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data)
   next_marker = data->file->offset;
   next_marker += grub_jpeg_get_word (data);
 
+  while (data->file->offset + sizeof (data->quan_table[id]) + 1 <= next_marker)
+    {
   id = grub_jpeg_get_byte (data);
   if (id >= 0x10)              /* Upper 4-bit is precision.  */
     return grub_error (GRUB_ERR_BAD_FILE_TYPE,
@@ -241,6 +246,8 @@ grub_jpeg_decode_quan_table (struct grub_jpeg_data *data)
   if (grub_file_read (data->file, &data->quan_table[id], 64) != 64)
     return grub_errno;
 
+    }
+
   if (data->file->offset != next_marker)
     grub_error (GRUB_ERR_BAD_FILE_TYPE,
                "jpeg: extra byte in quantization table");