An image causes crash with STATUS_STACK_BUFFER_OVERRUN

[Boscop]

I'm using mozjpeg-sys 0.10.4 to load jpeg images (because the image crate is much slower).
It usually works but I encountered a jpg file that causes it to crash with (exit code: 0xc0000409, STATUS_STACK_BUFFER_OVERRUN).

It's this jpg file.
I'm loading it like this:

fn load_jpeg(path: &str) -> io::Result<(Vec<u8>, u32, u32)> {
	use mozjpeg_sys::*;
	use std::{ffi::CString, mem};
	unsafe {
		let mut err: jpeg_error_mgr = mem::zeroed();
		let mut dinfo: jpeg_decompress_struct = mem::zeroed();
		dinfo.common.err = jpeg_std_error(&mut err);
		jpeg_create_decompress(&mut dinfo);

		let path = CString::new(path.as_bytes()).unwrap();
		let mode = CString::new("rb").unwrap();
		let fh = libc::fopen(path.as_ptr(), mode.as_ptr());
		jpeg_stdio_src(&mut dinfo, fh);
		jpeg_read_header(&mut dinfo, true as boolean);

		let width = dinfo.image_width;
		let height = dinfo.image_height;

		dinfo.out_color_space = J_COLOR_SPACE::JCS_RGB;
		jpeg_start_decompress(&mut dinfo);
		let row_stride = dinfo.image_width as usize * dinfo.output_components as usize;
		let buffer_size = row_stride * dinfo.image_height as usize;
		let mut buffer = vec![0u8; buffer_size];

		while dinfo.output_scanline < dinfo.output_height {
			let offset = dinfo.output_scanline as usize * row_stride;
			let mut jsamparray = [buffer[offset ..].as_mut_ptr()];
			jpeg_read_scanlines(&mut dinfo, jsamparray.as_mut_ptr(), 1);
		}

		jpeg_finish_decompress(&mut dinfo);
		jpeg_destroy_decompress(&mut dinfo);
		libc::fclose(fh);

		Ok((buffer, width, height))
	}
}

Am I doing something wrong? It works with other jpg files..

[kornelski]

Can you check with a debugger what code hits that?

[Boscop]

I ran it with msvc debugger but it pointed to random code that happens afterwards (tried multiple runs), which can't be. I think it's because the stack gets corrupted..