The problematic loop is the while loop in this snippet from libjbig/jbig.c:jbg_dec_in():
/* read in DPTABLE */
if (s->bie_len < 20 + 1728 &&
(s->options & (JBG_DPON | JBG_DPPRIV | JBG_DPLAST)) ==
(JBG_DPON | JBG_DPPRIV)) {
assert(s->bie_len >= 20);
while (s->bie_len < 20 + 1728 && *cnt < len)
s->buffer[s->bie_len++ - 20] = data[(*cnt)++];
if (s->bie_len < 20 + 1728)
return JBG_EAGAIN;
if (!s->dppriv || s->dppriv == jbg_dptable)
s->dppriv = (char *) checked_malloc(1728, sizeof(char));
jbg_dppriv2int(s->dppriv, s->buffer);
}
s->buffer has only 20 bytes, and the loop copies much more than that.
