diff options
author | Jorim Jaggi <jjaggi@google.com> | 2016-11-29 13:12:48 +0100 |
---|---|---|
committer | Jorim Jaggi <jjaggi@google.com> | 2016-12-02 11:18:10 +0000 |
commit | 890381c983b6eca60a435ebf5a4bdbd7a32660f0 (patch) | |
tree | e5c19c26fc748743c3956d06a2c0492610f9c3c4 | |
parent | c9f4debdb17e1f3b9fca74a03f6593c12aa9327d (diff) | |
download | libgdx-890381c983b6eca60a435ebf5a4bdbd7a32660f0.tar.gz |
Fix security vulnerability
Change-Id: I19028233d2ce79ef08947f00d2ecba20312579cc
Fixes: 32769670
(cherry picked from commit 28d83109cba8e1949032c78465649ba21db2d22e)
-rw-r--r-- | gdx/jni/gdx2d/jpgd.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/gdx/jni/gdx2d/jpgd.cpp b/gdx/jni/gdx2d/jpgd.cpp index 3873dfbe2..4c84a3321 100644 --- a/gdx/jni/gdx2d/jpgd.cpp +++ b/gdx/jni/gdx2d/jpgd.cpp @@ -2231,7 +2231,10 @@ void jpeg_decoder::make_huff_table(int index, huff_tables *pH) for (l = 1; l <= 16; l++) { for (i = 1; i <= m_huff_num[index][l]; i++) + { + JPGD_ASSERT(p < 257); huffsize[p++] = static_cast<uint8>(l); + } } huffsize[p] = 0; @@ -2246,6 +2249,7 @@ void jpeg_decoder::make_huff_table(int index, huff_tables *pH) { while (huffsize[p] == si) { + JPGD_ASSERT(p < 257); huffcode[p++] = code; code++; } |