From d0baa634a238361baaa5c4347c1ae066ca4158ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rcio=20Pais?= <MarcioPais@users.noreply.github.com>
Date: Fri, 16 Mar 2018 11:42:44 +0100
Subject: [PATCH 1/2] Improve JPEG parsing

- Require a DQT (Define Quantization Table) marker to accept a valid detection
- Perform some light validation of DQT and DHT markers
---
 precomp.cpp | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/precomp.cpp b/precomp.cpp
index 71f23fc..c8d776a 100644
--- a/precomp.cpp
+++ b/precomp.cpp
@@ -4292,6 +4292,7 @@ bool compress_file(float min_percent, float max_percent) {
         saved_cb = cb;
 
         bool done = false, found = false;
+        bool hasQuantTable = (in_buf[cb + 3] == 0xDB);
         bool progressive_flag = (in_buf[cb + 3] == 0xC2);
         input_file_pos+=2;
 
@@ -4299,13 +4300,32 @@ bool compress_file(float min_percent, float max_percent) {
           seek_64(fin, input_file_pos );
           if ((fread(in, 1, 5, fin) != 5) || (in[0] != 0xFF))
               break;
-
+          int length = (int)in[2]*256+(int)in[3];
           switch (in[1]){
-            case 0xDA : found = true;
+            case 0xDB : {
+              // FF DB XX XX QtId ...
+              // Marker length (XX XX) must be = 2 + (multiple of 65 <= 260)
+              // QtId:
+              // bit 0..3: number of QT (0..3, otherwise error)
+              // bit 4..7: precision of QT, 0 = 8 bit, otherwise 16 bit               
+              if (length<=262 && ((length-2)%65)==0 && in[4]<=3) {
+                hasQuantTable = true;
+                offset += length+2;
+              }
+              else
+                done = true;
+              break;
+            }
+            case 0xC4 : {
+              done = ((in[4]&0xF)>3 || (in[4]>>4)>1);
+              offset += length+2;
+              break;
+            }
+            case 0xDA : found = hasQuantTable;
             case 0xD9 : done = true; break; //EOI with no SOS?
             case 0xC2 : progressive_flag = true;
             case 0xC0 : done = (in[4] != 0x08);
-            default: input_file_pos += in[2]*256+in[3]+2;
+            default: input_file_pos += length+2;
           }
         }
         while (!done);

From d802de0e88f7e5203483fb6813299359ba8324d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1rcio=20Pais?= <MarcioPais@users.noreply.github.com>
Date: Fri, 16 Mar 2018 12:03:19 +0100
Subject: [PATCH 2/2] Fix copy-paste error

---
 precomp.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/precomp.cpp b/precomp.cpp
index c8d776a..58c77ba 100644
--- a/precomp.cpp
+++ b/precomp.cpp
@@ -4310,7 +4310,7 @@ bool compress_file(float min_percent, float max_percent) {
               // bit 4..7: precision of QT, 0 = 8 bit, otherwise 16 bit               
               if (length<=262 && ((length-2)%65)==0 && in[4]<=3) {
                 hasQuantTable = true;
-                offset += length+2;
+                input_file_pos += length+2;
               }
               else
                 done = true;
@@ -4318,7 +4318,7 @@ bool compress_file(float min_percent, float max_percent) {
             }
             case 0xC4 : {
               done = ((in[4]&0xF)>3 || (in[4]>>4)>1);
-              offset += length+2;
+              input_file_pos += length+2;
               break;
             }
             case 0xDA : found = hasQuantTable;