From 23fc49edee70ecb7869fb5b0391840ff6ec6798b Mon Sep 17 00:00:00 2001
From: Naveed Khan <dxbnaveed.k@gmail.com>
Date: Thu, 22 Oct 2026 23:01:00 +0530
Subject: [PATCH] reject out-of-range marker codes in jpegli_save_markers

---
 lib/jpegli/decode.cc              |  2 +-
 lib/jpegli/error_handling_test.cc | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/jpegli/decode.cc b/lib/jpegli/decode.cc
index cd0feb9a..1e8f3130 100644
--- a/lib/jpegli/decode.cc
+++ b/lib/jpegli/decode.cc
@@ -597,7 +597,7 @@ void jpegli_save_markers(j_decompress_ptr cinfo, int marker_code,
                          unsigned int length_limit) {
   // TODO(szabadka) Limit our memory usage by taking into account length_limit.
   jpeg_decomp_master* m = cinfo->master;
-  if (marker_code < 0xe0) {
+  if (marker_code < 0xe0 || marker_code > 0xff) {
     JPEGLI_ERROR("jpegli_save_markers: invalid marker code %d", marker_code);
   }
   m->markers_to_save_[marker_code - 0xe0] = 1;
diff --git a/lib/jpegli/error_handling_test.cc b/lib/jpegli/error_handling_test.cc
index fb39c939..beb89e15 100644
--- a/lib/jpegli/error_handling_test.cc
+++ b/lib/jpegli/error_handling_test.cc
@@ -1078,6 +1078,18 @@ TEST(DecoderErrorHandlingTest, MinimalSuccess) {
   jpegli_destroy_decompress(&cinfo);
 }
 
+TEST(DecoderErrorHandlingTest, InvalidSaveMarkersCode) {
+  jpeg_decompress_struct cinfo = {};
+  const auto try_catch_block = [&]() -> bool {
+    ERROR_HANDLER_SETUP(jpegli);
+    jpegli_create_decompress(&cinfo);
+    jpegli_save_markers(&cinfo, 0x100, 0xffff);
+    return true;
+  };
+  EXPECT_FALSE(try_catch_block());
+  jpegli_destroy_decompress(&cinfo);
+}
+
 TEST(DecoderErrorHandlingTest, NoSource) {
   jpeg_decompress_struct cinfo = {};
   const auto try_catch_block = [&]() -> bool {