Commit 8fb37b81713a0cdc14622dc08892ebd28a3233aa
2015-08-13T11:09:05
Fix cjpeg segfault when Windows BMP width/height<0 rdbmp.c used the ambiguous INT32 datatype, which is sometimes typedef'ed to long. Windows bitmap headers use 32-bit signed integers for the width and height, because height can sometimes be negative (this indicates a top-down bitmap.) If biWidth or biHeight was negative and INT32 was a 64-bit long, then biWidth and biHeight were read as a positive integer > INT32_MAX, which failed the test in line 385: if (biWidth <= 0 || biHeight <= 0) ERREXIT(cinfo, JERR_BMP_EMPTY); This commit refactors rdbmp.c so that it uses the datatypes specified by Microsoft for the Windows BMP header. This closes #9 and also provides a better solution for mozilla/mozjpeg#153.