From 99b06d1a812d321986d2dda25865860e72992e2a Mon Sep 17 00:00:00 2001
From: tabudz <tanb74653@gmail.com>
Date: Mon, 24 Nov 2025 15:34:21 +0800
Subject: [PATCH] Handle NULL buffer when discarding rows

---
 libuvccamera/src/main/jni/libjpeg-turbo/jdpostct.c | 5 +++++
 libuvccamera/src/main/jni/libjpeg-turbo/jerror.h   | 1 +
 libuvccamera/src/main/jni/libjpeg-turbo/jquant1.c  | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/libuvccamera/src/main/jni/libjpeg-turbo/jdpostct.c b/libuvccamera/src/main/jni/libjpeg-turbo/jdpostct.c
index 6a2cf5c..8871b43 100644
--- a/libuvccamera/src/main/jni/libjpeg-turbo/jdpostct.c
+++ b/libuvccamera/src/main/jni/libjpeg-turbo/jdpostct.c
@@ -137,6 +137,11 @@ post_process_1pass(j_decompress_ptr cinfo, JSAMPIMAGE input_buf,
   my_post_ptr post = (my_post_ptr)cinfo->post;
   JDIMENSION num_rows, max_rows;
 
+  /* read_and_discard_scanlines may call it with rows "available", but no buffer */
+  if (output_buf == NULL) {
+    return;
+  }
+
   /* Fill the buffer, but not more than what we can dump out in one go. */
   /* Note we rely on the upsampler to detect bottom of image. */
   max_rows = out_rows_avail - *out_row_ctr;
diff --git a/libuvccamera/src/main/jni/libjpeg-turbo/jerror.h b/libuvccamera/src/main/jni/libjpeg-turbo/jerror.h
index 4476df2..93e1907 100644
--- a/libuvccamera/src/main/jni/libjpeg-turbo/jerror.h
+++ b/libuvccamera/src/main/jni/libjpeg-turbo/jerror.h
@@ -206,6 +206,7 @@ JMESSAGE(JERR_NO_ARITH_TABLE, "Arithmetic table 0x%02x was not defined")
 JMESSAGE(JWRN_ARITH_BAD_CODE, "Corrupt JPEG data: bad arithmetic code")
 #endif
 #endif
+JMESSAGE(JERR_BAD_PARAM, "Bogus parameter")
 JMESSAGE(JWRN_BOGUS_ICC, "Corrupt JPEG data: bad ICC marker")
 #if JPEG_LIB_VERSION < 70
 JMESSAGE(JERR_BAD_DROP_SAMPLING,
diff --git a/libuvccamera/src/main/jni/libjpeg-turbo/jquant1.c b/libuvccamera/src/main/jni/libjpeg-turbo/jquant1.c
index 73b83e1..df4c698 100644
--- a/libuvccamera/src/main/jni/libjpeg-turbo/jquant1.c
+++ b/libuvccamera/src/main/jni/libjpeg-turbo/jquant1.c
@@ -473,6 +473,10 @@ color_quantize(j_decompress_ptr cinfo, JSAMPARRAY input_buf,
   JDIMENSION width = cinfo->output_width;
   register int nc = cinfo->out_color_components;
 
+  if (output_buf == NULL && num_rows) {
+    ERREXIT(cinfo, JERR_BAD_PARAM);
+  }
+
   for (row = 0; row < num_rows; row++) {
     ptrin = input_buf[row];
     ptrout = output_buf[row];