[Mjpeg-users] bug in jpeg2yuv.c ?

[Wolfgang R. <>]

when trying to convert the image bla.jpg with

  jpeg2yuv -f 25 -j bla.jpg -I p -n 1 > bla.out

the program crashes with core dump. The valgrind
memory checker pointed the problem to be  in 

jpegutils.c:608: decode_jpeg_raw()       raw0[xd++] = row0[y][xs++];

where data is copied to invalid memory of raw0. 

Using gdb verifies that

jpeg2yuv.c:363   

yuv[0] = malloc(param->width * param->height * sizeof(yuv[0][0]));
yuv[1] = malloc(param->width * param->height / 4 * sizeof(yuv[1][0]));
yuv[2] = malloc(param->width * param->height / 4 * sizeof(yuv[2][0]));

does not allocate enough memory for 

jpegutils::decode_jpeg_raw()  

and the program crashes because memory was overwritten for variable dinfo
which causes jpeg_destroy_decompress() to crash.


I was using the packages

jpeg-mmx-0.1.4.tar.gz
libmovtar-0.1.3.tar.gz
mjpegtools-1.6.1.92.tar.gz
quicktime4linux-1.4-patched-2.tar.gz

on a Debian Sarge (testing) system with gcc-3.3.2


I hope this report will help to improve future versions of this great software

br.

   Wolfgang