{"record":{"id":"175c266a0036cfde","repo":"DrKLO/Telegram","slug":"memory-allocation-failure","errorCode":null,"errorMessage":"Memory allocation failure!\n","messagePattern":"Memory allocation failure!\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"TMessagesProj/jni/mozjpeg/jpegyuv.c","lineNumber":102,"sourceCode":"\n  jpeg_read_header(&cinfo, TRUE);\n\n  cinfo.raw_data_out = TRUE;\n  cinfo.do_fancy_upsampling = FALSE;\n\n  jpeg_start_decompress(&cinfo);\n\n  luma_width = cinfo.output_width;\n  luma_height = cinfo.output_height;\n\n  chroma_width = (luma_width + 1) >> 1;\n  chroma_height = (luma_height + 1) >> 1;\n\n  yuv_size = luma_width*luma_height + 2*chroma_width*chroma_height;\n  yuv_buffer = malloc(yuv_size);\n  if (!yuv_buffer) {\n    fclose(jpg_fd);\n    fprintf(stderr, \"Memory allocation failure!\\n\");\n    return 1;\n  }\n\n  frame_width = (cinfo.output_width + (16 - 1)) & ~(16 - 1);\n\n  jpg_buffer = malloc(frame_width*16 + 2*(frame_width/2)*8);\n  if (!jpg_buffer) {\n    fclose(jpg_fd);\n    free(yuv_buffer);\n    fprintf(stderr, \"Memory allocation failure!\\n\");\n    return 1;\n  }\n\n  plane_pointer[0] = yrow_pointer;\n  plane_pointer[1] = cbrow_pointer;\n  plane_pointer[2] = crrow_pointer;\n\n  for (y = 0; y < 16; y++) {","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/DrKLO/Telegram/blob/45ab8f4308496e1f01026a97fcdb0d58a5274474/TMessagesProj/jni/mozjpeg/jpegyuv.c#L84-L120","documentation":"jpegyuv allocates the YUV output buffer with malloc(yuv_size) at jpegyuv.c:99, where yuv_size = luma_width*luma_height + 2*chroma_width*chroma_height. If malloc returns NULL, the image is too large for available memory. The program closes the JPEG file, prints the error, and returns 1.","triggerScenarios":"Processing a very high-resolution JPEG (e.g. 10000x10000) where yuv_size exceeds available RAM. Integer overflow in yuv_size calculation producing an unexpected value (the variables are int, so images larger than ~46340x46340 overflow). System under memory pressure.","commonSituations":"Processing a full-resolution camera photo (e.g. 40MP = ~2400x16000) on a memory-constrained device. Multiple concurrent image conversions. Integer overflow in the multiplication making yuv_size negative or zero, which malloc handles as a tiny allocation (not NULL) or an error.","solutions":["Downscale the image before converting to YUV, or process in tiles","Check image dimensions before calling jpegyuv and reject images larger than a threshold","Free other memory in the calling process before invoking jpegyuv","Fix the integer overflow: use size_t or int64_t for yuv_size and dimension calculations"],"exampleFix":"// before\n// no dimension check, potential int overflow in yuv_size\n\n// after\n// validate dimensions before calling\nif (width > 8192 || height > 8192) {\n    fprintf(stderr, \"Image too large for YUV conversion: %dx%d\\n\", width, height);\n    return -1;\n}\n// also fix yuv_size type in jpegyuv.c:\n// size_t yuv_size = (size_t)luma_width*(size_t)luma_height\n//   + 2*(size_t)chroma_width*(size_t)chroma_height;","handlingStrategy":"validation","validationCode":"// Read JPEG dimensions and validate memory feasibility before calling jpegyuv\n#include \"jpeglib.h\"\nint validate_jpeg_dimensions(const char *path, int max_dim) {\n    struct jpeg_decompress_struct cinfo;\n    struct jpeg_error_mgr jerr;\n    cinfo.err = jpeg_std_error(&jerr);\n    jpeg_create_decompress(&cinfo);\n    FILE *f = fopen(path, \"rb\");\n    if (!f) { jpeg_destroy_decompress(&cinfo); return -1; }\n    jpeg_stdio_src(&cinfo, f);\n    jpeg_read_header(&cinfo, TRUE);\n    int w = cinfo.image_width, h = cinfo.image_height;\n    fclose(f); jpeg_destroy_decompress(&cinfo);\n    if (w <= 0 || h <= 0 || w > max_dim || h > max_dim) return -1;\n    // Check yuv_size won't overflow int: w*h + 2*(w/2)*(h/2)\n    long yuv = (long)w * h + 2L * (long)((w+1)/2) * (long)((h+1)/2);\n    if (yuv > 100*1024*1024) return -1; // cap at 100MB\n    return 0;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate image dimensions are within a reasonable range before calling jpegyuv","Check that yuv_size (width*height + 2*chroma) fits in available memory","Downscale very large images before YUV conversion"],"tags":["jpeg","jpegyuv","memory","malloc","integer-overflow","large-image"],"backgroundTag":null,"analyzedSha":"45ab8f4308496e1f01026a97fcdb0d58a5274474","analyzedAt":"2026-08-14T05:19:30.815Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}