diff options
author | Jorim Jaggi <jjaggi@google.com> | 2016-12-07 22:51:27 +0000 |
---|---|---|
committer | android-build-merger <android-build-merger@google.com> | 2016-12-07 22:51:27 +0000 |
commit | 9df7875d100fb5c61bdf1524a2f11abee5c8ed8a (patch) | |
tree | e5c19c26fc748743c3956d06a2c0492610f9c3c4 | |
parent | 2711dadbedb03a82fb7ed959957bf1c78fd56628 (diff) | |
parent | e1508f990bd8465562218b76d041e31a8108379e (diff) | |
download | libgdx-9df7875d100fb5c61bdf1524a2f11abee5c8ed8a.tar.gz |
Fix security vulnerability am: 890381c983
am: e1508f990b
Change-Id: I266586294b2309f847cd539f792a866a050428fc
-rw-r--r-- | gdx/jni/gdx2d/jpgd.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/gdx/jni/gdx2d/jpgd.cpp b/gdx/jni/gdx2d/jpgd.cpp index 3873dfbe2..4c84a3321 100644 --- a/gdx/jni/gdx2d/jpgd.cpp +++ b/gdx/jni/gdx2d/jpgd.cpp @@ -2231,7 +2231,10 @@ void jpeg_decoder::make_huff_table(int index, huff_tables *pH) for (l = 1; l <= 16; l++) { for (i = 1; i <= m_huff_num[index][l]; i++) + { + JPGD_ASSERT(p < 257); huffsize[p++] = static_cast<uint8>(l); + } } huffsize[p] = 0; @@ -2246,6 +2249,7 @@ void jpeg_decoder::make_huff_table(int index, huff_tables *pH) { while (huffsize[p] == si) { + JPGD_ASSERT(p < 257); huffcode[p++] = code; code++; } |