diff options
| author | Leon Scroggins III <scroggo@google.com> | 2017-02-07 16:34:51 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2017-02-07 16:34:51 +0000 |
| commit | d2456e3a125ab64ab7be771740a2b3ce7da9bdc9 (patch) | |
| tree | 71579b250c6b7ce6f41232327736229da40a0ca0 | |
| parent | 6e6cc8714c3ba90455b4d880a40f3649f04ac7cf (diff) | |
| parent | 16882f721279a82a1c860ac689ce570b16fe26a0 (diff) | |
| download | skia-d2456e3a125ab64ab7be771740a2b3ce7da9bdc9.tar.gz | |
Fix out of bounds memory read in GIFMovie.cpp
am: 16882f7212
Change-Id: I039cadfad5fe0f898cf13b42282f65d5ab0170e7
| -rw-r--r-- | src/images/SkMovie_gif.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/images/SkMovie_gif.cpp b/src/images/SkMovie_gif.cpp index decefd5acc..9dedfc0aab 100644 --- a/src/images/SkMovie_gif.cpp +++ b/src/images/SkMovie_gif.cpp @@ -116,7 +116,7 @@ static void copyLine(uint32_t* dst, const unsigned char* src, const ColorMapObje int transparent, int width) { for (; width > 0; width--, src++, dst++) { - if (*src != transparent) { + if (*src != transparent && *src < cmap->ColorCount) { const GifColorType& col = cmap->Colors[*src]; *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue); } |