two bug in jpeg encoding about libjpeg

[thorfdbg]

Yes, thank you. Those two issues are fixed - on this particular input. One problem was that the input bitmap hook could not report an error if requesting or releasing a bitmap did not work. This has been fixed and the code was extended to collect such error codes to the caller.

However, please note that the example code in the "cmd" directory is not particular robust, and is not attempted to constitute a robust implementation. If the code is required to operate in a hostile environment, the bitmap hook implementation needs to sanetize its input as the library encoder (not the decoder!) operates under the assumption that input data is valid (i.e. "garbadge-in garbadge-out"). If that cannot be assumed, the bitmap hook is required to perform such validation, and generate an error (or fix the data).

[samueloph]

Two CVEs were assigned to this bugreport, one for each bug:

CVE-2023-37836 and CVE-2023-37837

Note: I didn't have any involvement in this assignment, I'm just posting here for reference.

This seems to be the fixing commit:
9e0cea2