Several integer overflow issues and subsequent segfaults occur in libjpeg-turbo when attempting to compress or decompress gigapixel images.
Created libjpeg-turbo tracking bugs for this issue:
Affects: fedora-all [bug 1770988]
Created mingw-libjpeg-turbo tracking bugs for this issue:
Affects: epel-7 [bug 1770990]
Affects: fedora-all [bug 1770989]
The initial commit done by upstream at https://github.com/libjpeg-turbo/libjpeg-turbo/commit/2a9e3bd7430cfda1bc812d139e0609c6aca0b884 is incomplete, and should be followed by the commit at: https://github.com/clearlinux-pkgs/libjpeg-turbo/commit/0a5d06c3dd4a64754d7e6ffa081fd9132714f74c
This is flaw is an integer overflow, due to large image sizes i.e. more than one billion pixels. It could lead to subsequent buffer overflows later in the code. However you need a really large image to trigger this.
*** Bug 1850483 has been marked as a duplicate of this bug. ***
As mentioned in comment #2, there are two commits which are needed to fix this flaw:
1. https://github.com/libjpeg-turbo/libjpeg-turbo/commit/2a9e3bd7430cfda1bc812d139e0609c6aca0b884 -> this is a part of libjpeg-turbo 2.0.3
2. https://github.com/libjpeg-turbo/libjpeg-turbo/commit/c30b1e72dac76343ef9029833d1561de07d29bad -> this is a part of libjpeg-turbo 2.0.4
*** Bug 1850477 has been marked as a duplicate of this bug. ***