[gthumb] jpeg loader: error if the orientation swaps width and height

[Paolo Bacchilega <paobac src gnome org>]

commit 6e56da85c9ad12b3c24071db17377e6cdc11efe6
Author: Paolo Bacchilega <paobac src gnome org>
Date:   Mon Dec 16 17:24:28 2019 +0100

    jpeg loader: error if the orientation swaps width and height
    
    The cairo surface could have the width and height swapped
    compared to the original image if the image orientation is
    rotated.

 extensions/cairo_io/cairo-image-surface-jpeg.c | 28 +++++++++++++++-----------
 1 file changed, 16 insertions(+), 12 deletions(-)
---
diff --git a/extensions/cairo_io/cairo-image-surface-jpeg.c b/extensions/cairo_io/cairo-image-surface-jpeg.c
index e0e7379e..7bdef9e3 100644
--- a/extensions/cairo_io/cairo-image-surface-jpeg.c
+++ b/extensions/cairo_io/cairo-image-surface-jpeg.c
@@ -155,6 +155,8 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
        JpegInfoFlags                  info_flags;
        gboolean                       load_scaled;
        GthTransform                   orientation;
+       int                            output_width;
+       int                            output_height;
        int                            destination_width;
        int                            destination_height;
        int                            line_start;
@@ -263,9 +265,11 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
 
        jpeg_start_decompress (&srcinfo);
 
+       output_width = MIN (srcinfo.output_width, CAIRO_MAX_IMAGE_SIZE);
+       output_height = MIN (srcinfo.output_height, CAIRO_MAX_IMAGE_SIZE);
        _cairo_image_surface_transform_get_steps (CAIRO_FORMAT_ARGB32,
-                                                 MIN (srcinfo.output_width, CAIRO_MAX_IMAGE_SIZE),
-                                                 MIN (srcinfo.output_height, CAIRO_MAX_IMAGE_SIZE),
+                                                 output_width,
+                                                 output_height,
                                                  orientation,
                                                  &destination_width,
                                                  &destination_height,
@@ -304,7 +308,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                        CMYK_table_init ();
                        cmyk_tab = CMYK_Tab;
 
-                       while (srcinfo.output_scanline < destination_height) {
+                       while (srcinfo.output_scanline < output_height) {
                                if (g_cancellable_is_cancelled (cancellable))
                                        goto stop_loading;
 
@@ -318,7 +322,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                                        if (g_cancellable_is_cancelled (cancellable))
                                                goto stop_loading;
 
-                                       for (x = 0; x < destination_width; x++) {
+                                       for (x = 0; x < output_width; x++) {
                                                if (srcinfo.saw_Adobe_marker) {
                                                        c = p_buffer[0];
                                                        m = p_buffer[1];
@@ -352,7 +356,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
 
        case JCS_GRAYSCALE:
                {
-                       while (srcinfo.output_scanline < destination_height) {
+                       while (srcinfo.output_scanline < output_height) {
                                if (g_cancellable_is_cancelled (cancellable))
                                        goto stop_loading;
 
@@ -366,7 +370,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                                        if (g_cancellable_is_cancelled (cancellable))
                                                goto stop_loading;
 
-                                       for (x = 0; x < destination_width; x++) {
+                                       for (x = 0; x < output_width; x++) {
                                                r = g = b = p_buffer[0];
                                                pixel = CAIRO_RGBA_TO_UINT32 (r, g, b, 0xff);
                                                memcpy (p_surface, &pixel, sizeof (guint32));
@@ -384,7 +388,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
 
        case JCS_RGB:
                {
-                       while (srcinfo.output_scanline < destination_height) {
+                       while (srcinfo.output_scanline < output_height) {
                                if (g_cancellable_is_cancelled (cancellable))
                                        goto stop_loading;
 
@@ -398,7 +402,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                                        if (g_cancellable_is_cancelled (cancellable))
                                                goto stop_loading;
 
-                                       for (x = 0; x < destination_width; x++) {
+                                       for (x = 0; x < output_width; x++) {
                                                r = p_buffer[0];
                                                g = p_buffer[1];
                                                b = p_buffer[2];
@@ -431,7 +435,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                        g_cr_tab = YCbCr_G_Cr_Tab;
                        b_cb_tab = YCbCr_B_Cb_Tab;
 
-                       while (srcinfo.output_scanline < destination_height) {
+                       while (srcinfo.output_scanline < output_height) {
                                if (g_cancellable_is_cancelled (cancellable))
                                        goto stop_loading;
 
@@ -445,7 +449,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                                        if (g_cancellable_is_cancelled (cancellable))
                                                goto stop_loading;
 
-                                       for (x = 0; x < destination_width; x++) {
+                                       for (x = 0; x < output_width; x++) {
                                                Y = p_buffer[0];
                                                Cb = p_buffer[1];
                                                Cr = p_buffer[2];
@@ -486,7 +490,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                        CMYK_table_init ();
                        cmyk_tab = CMYK_Tab;
 
-                       while (srcinfo.output_scanline < destination_height) {
+                       while (srcinfo.output_scanline < output_height) {
                                if (g_cancellable_is_cancelled (cancellable))
                                        goto stop_loading;
 
@@ -500,7 +504,7 @@ _cairo_image_surface_create_from_jpeg (GInputStream  *istream,
                                        if (g_cancellable_is_cancelled (cancellable))
                                                goto stop_loading;
 
-                                       for (x = 0; x < destination_width; x++) {
+                                       for (x = 0; x < output_width; x++) {
                                                Y = p_buffer[0];
                                                Cb = p_buffer[1];
                                                Cr = p_buffer[2];