Fix the spinguard logic for big buffers. (#494667, Ed Catmur)

2007-12-09  Matthias Clasen  <mclasen@redhat.com>

        * io-jpeg.c: Fix the spinguard logic for big buffers.
        (#494667, Ed Catmur)

svn path=/trunk/; revision=19135

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index 593ff30c307dd57e6dcc980c2b76f9a92517aa1b..0c3da6bfe2c3e82df24a4e3ead661c66c8563d75 100644 (file)
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,8 @@
+2007-12-09  Matthias Clasen  <mclasen@redhat.com>
+
+       * io-jpeg.c: Fix the spinguard logic for big buffers.
+       (#494667, Ed Catmur)
+       
 2007-11-25  Tor Lillqvist  <tml@novell.com>
 
        * Makefile.am: Fix static build of the icns loader.

diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c
index fdcc3e2cb45bdfba99fd6511d27f8d5eb5fc6634..7df7e1cd5c0b3fe0d7a41cee36dfab3b1f108b50 100644 (file)
--- a/gdk-pixbuf/io-jpeg.c
+++ b/gdk-pixbuf/io-jpeg.c
@@ -812,7 +812,7 @@ gdk_pixbuf__jpeg_image_load_increment (gpointer data,
        struct           jpeg_decompress_struct *cinfo;
        my_src_ptr       src;
        guint            num_left, num_copy;
-       guint            last_bytes_left;
+       guint            last_num_left, last_bytes_left;
        guint            spinguard;
        gboolean         first;
        const guchar    *bufhd;
@@ -853,6 +853,7 @@ gdk_pixbuf__jpeg_image_load_increment (gpointer data,
        if (num_left == 0)
                return TRUE;
 
+       last_num_left = num_left;
        last_bytes_left = 0;
        spinguard = 0;
        first = TRUE;
@@ -880,10 +881,13 @@ gdk_pixbuf__jpeg_image_load_increment (gpointer data,
                 if (first) {
                         last_bytes_left = src->pub.bytes_in_buffer;
                         first = FALSE;
-                } else if (src->pub.bytes_in_buffer == last_bytes_left)
+                } else if (src->pub.bytes_in_buffer == last_bytes_left
+                          && num_left == last_num_left) {
                         spinguard++;
-                else
+               } else {
                         last_bytes_left = src->pub.bytes_in_buffer;
+                       last_num_left = num_left;
+               }
 
                /* should not go through twice and not pull bytes out of buf */
                if (spinguard > 2)