What causes "%s: skip region exceeds image height %d\n" in DrKLO/Telegram?

Query the image height first (jpeg_read_header then read output_height) and compute skip_end from actual dimensions.

%s: skip region exceeds image height %d\n

Error message

%s: skip region exceeds image height %d\n

What it means

The -skip option specified a skip region whose end row (skip_end) exceeds the image's actual output height (output_height - 1). This check runs after jpeg_start_decompress(), because output_height is only valid then. The program exits with failure; it is fatal.

Source

Thrown at TMessagesProj/jni/mozjpeg/djpeg.c:692

  default:
    ERREXIT(&cinfo, JERR_UNSUPPORTED_FORMAT);
    break;
  }
  dest_mgr->output_file = output_file;

  /* Start decompressor */
  (void)jpeg_start_decompress(&cinfo);

  /* Skip rows */
  if (skip) {
    JDIMENSION tmp;

    /* Check for valid skip_end.  We cannot check this value until after
     * jpeg_start_decompress() is called.  Note that we have already verified
     * that skip_start <= skip_end.
     */
    if (skip_end > cinfo.output_height - 1) {
      fprintf(stderr, "%s: skip region exceeds image height %d\n", progname,
              cinfo.output_height);
      exit(EXIT_FAILURE);
    }

    /* Write output file header.  This is a hack to ensure that the destination
     * manager creates an output image of the proper size.
     */
    tmp = cinfo.output_height;
    cinfo.output_height -= (skip_end - skip_start + 1);
    (*dest_mgr->start_output) (&cinfo, dest_mgr);
    cinfo.output_height = tmp;

    /* Process data */
    while (cinfo.output_scanline < skip_start) {
      num_scanlines = jpeg_read_scanlines(&cinfo, dest_mgr->buffer,
                                          dest_mgr->buffer_height);
      (*dest_mgr->put_pixel_rows) (&cinfo, dest_mgr, num_scanlines);
    }

View on GitHub (pinned to 45ab8f4308)

Solutions

Query the image height first (jpeg_read_header then read output_height) and compute skip_end from actual dimensions.
Clamp skip_end to output_height - 1 before passing the -skip argument.
Re-derive skip parameters from the current JPEG rather than reusing constants from another image.
Validate skip_start <= skip_end < output_height in your wrapper before invoking djpeg.

Example fix

// before
./djpeg -skip 0-9999 small.jpg > out.ppm
// after: clamp to actual height
H=$(jpeginfo -h small.jpg)  # or read via jpeg_read_header
END=$((H - 1))
./djpeg -skip 0-$END small.jpg > out.ppm

Defensive patterns

Strategy: validation

Validate before calling

#include <jpeglib.h>
/* after jpeg_read_header + jpeg_start_decompress, validate skip */
int skip_ok(j_decompress_ptr c, int skip_start, int skip_end) {
  return skip_start <= skip_end && skip_end <= (int)c->output_height - 1;
}

Prevention

Always derive skip_end from the actual output_height at runtime.
Clamp skip_end to output_height - 1 in the wrapper.
Never hardcode skip values across different images.

When it happens

Trigger: Passing -skip WxH or -skip start-end where skip_end is greater than or equal to the decompressed image height. The exact bound is checked post-start-decompress, so the error surfaces only at runtime once the JPEG header reveals the true dimensions.

Common situations: Hardcoding skip values from a different (larger) image, decoding a downsampled/rotated variant where height differs, or a JPEG whose dimensions changed after a previous transform pass.

Related errors

AI-assisted analysis of DrKLO/Telegram@45ab8f4308 (2026-08-14). Data as JSON: /api/errors/fa603f8642526011. Report an issue: GitHub.