The previous patch_jpegdec.py used in-place string replacement with a
single shared marker for two distinct DC writes (main store and
successive-approximation update). If only one of the two anchors
matched, the file was written half-patched and the shared marker locked
the partial state in for every subsequent run.
Generate the fixes as `git format-patch` artifacts under
scripts/jpegdec_patches/, then apply them in lexical order via
`git apply`. Idempotency is decided by git itself: `--check --reverse`
succeeds means already applied; `--check` succeeds means appliable;
neither aborts the build rather than leaving a half-patched file.
No behaviour change to the patched JPEGDEC source: same redirect, same
DC guards, same intent. Just stops the pre-build script from doing
something it has no business doing.
EIGHT_BIT_GRAYSCALE decode of a 3-component progressive JPEG calls
JPEGDecodeMCU_P with MCU_SKIP for Cb and Cr after every Y MCU. The
existing safe-pMCU patch redirects the wild pointer to &sMCUs[0] but
leaves the DC store unguarded, so each chroma skip overwrites the
just-decoded Y DC with the chroma DC predictor. Output reads sMCUs[0],
gets the trailing Cr DC (~0), and renders an all-black image.
Add `if (iMCU >= 0)` guards to the two pMCU[0] writes (main DC store
and successive-approximation update). The pointer redirect stays as the
AC wild-pointer defence; the new guards stop the silent corruption at
sMCUs[0]. The two fixes are independent and both required.
Jeremy Klein