fix: Wild pointer crash in JPEGDEC MCU_SKIP handling (#1627)

Adds a PlatformIO pre-build script to patch JPEGDEC library. When
decoding progressive JPEGs with AC coefficients, MCU_SKIP (-8) causes
array index 0xFFFFF8, creating a wild pointer ~33MB past the sMCUs
array. The patch redirects pMCU to sMCUs[0] when MCU_SKIP is active,
preventing store-access faults while maintaining correct behavior for
JPEG_SCALE_EIGHTH decoding. Devices with larger framebuffers (like the
x3) (792×528 = 52,272 bytes vs 800×480 = 48,000 bytes) have less free
heap, shifting the allocation and changing where the wild pointer lands.

Commit 8628297 guarded the DC coefficient write (pMCU[0]) with if (iMCU
>= 0), which prevents crashes for progressive JPEGs whose first scan is
DC-only (iScanEnd == 0). However, if the first scan includes AC
coefficients (iScanEnd > 0), the AC decode loop still writes through the
wild pointer and crashes.

This commit is contained in:

Justin Mitchell

2026-04-10 21:13:59 +01:00

committed by

GitHub

parent 14ec53a335

commit 83cd96bc2f

2 changed files with 69 additions and 0 deletions

									
										platformio.ini
									
		+1
		
												View File
												
				@@ -51,6 +51,7 @@ extra_scripts =

				  pre:scripts/build_html.py

				  pre:scripts/gen_i18n.py

				  pre:scripts/git_branch.py

				  pre:scripts/patch_jpegdec.py

				; Libraries

				lib_deps =