Skip to content

Return an error for malformed JPEG input - #1096

Open
ilia-sokolov wants to merge 1 commit into
microsoft:mainfrom
ilia-sokolov:contrib/1094-jpeg-error-status
Open

Return an error for malformed JPEG input#1096
ilia-sokolov wants to merge 1 commit into
microsoft:mainfrom
ilia-sokolov:contrib/1094-jpeg-error-status

Conversation

@ilia-sokolov

Copy link
Copy Markdown

Summary

  • replace libjpeg's process-terminating default fatal-error path with an OrtxStatus
  • keep all libjpeg-mutated recovery state in heap storage so setjmp/longjmp does not leave modified automatic C++ state indeterminate
  • clean up fully and partially initialized decompressors
  • treat truncated input and marker skips beyond the supplied buffer as corrupt data
  • prevent zero-scanline suspension returns from looping
  • preserve useful bounded libjpeg diagnostics

Root cause

The generic decoder installed jpeg_std_error without overriding error_exit. Fatal libjpeg errors therefore used the library's default handler, which can terminate the host process instead of returning an inference error.

Validation

A Linux build with the portable libjpeg backend passed all six image-decoder tests:

  • valid PNG and JPEG decoding
  • malformed JPEG headers and oversized marker skips
  • repeated truncation after JPEG output allocation
  • successful valid JPEG decoding after repeated failures
  • oversized PNG and JPEG rejection

git diff --check also passed.

Fixes #1094

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@ilia-sokolov
ilia-sokolov marked this pull request as ready for review July 28, 2026 06:26
Copilot AI review requested due to automatic review settings July 28, 2026 06:26
@ilia-sokolov
ilia-sokolov requested a review from a team as a code owner July 28, 2026 06:26
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the JPEG decoding path in DecodeImage so malformed or truncated JPEG inputs return an OrtxStatus instead of potentially terminating the host process via libjpeg’s default fatal error handler.

Changes:

  • Added a libjpeg error manager that uses setjmp/longjmp to convert fatal libjpeg errors into OrtxStatus failures.
  • Implemented a non-suspending in-memory JPEG source manager that treats truncation and out-of-bounds marker skips as corrupt data.
  • Expanded test coverage to ensure invalid JPEG inputs fail without process termination and that decoding still works after repeated failures.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
operators/vision/image_decoder.hpp Reworks JPEG decode to override libjpeg fatal error handling, keep mutable libjpeg state on the heap, and improve truncation/skip handling.
test/pp_api_test/test_imgcodec.cc Adds regression tests asserting invalid JPEGs return errors (not process exit) and that valid JPEG decoding still succeeds after failures.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +222 to +225
auto* const state =
new JpegDecodeState(encoded_image_data, encoded_image_data_len);
state->cinfo.err = jpeg_std_error(&state->error.base);
state->error.base.error_exit = &JpegErrorManager::ErrorExit;
Comment on lines +6 to 9
#include <csetjmp>
#include <cstdint>
#include <string>

Comment on lines +34 to +37
static void ErrorExit(j_common_ptr cinfo) {
auto* error = reinterpret_cast<JpegErrorManager*>(cinfo->err);
(*cinfo->err->format_message)(cinfo, error->message);
longjmp(error->jump_buffer, 1);
{0xFF, 0xD8, 0xFF, 0xE1, 0x7F, 0xFF, 0x00, 0x00, 0xFF, 0xD9},
};

for (auto encoded : invalid_images) {
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DecodeImage is causing my program to exit

2 participants