Bug 891693 - Make sure that huffval gets zeroed before use. r=DRC
authorMichael Zalewski <lcamtuf@coredump.cx>
Thu, 21 Nov 2013 10:48:32 -0500
changeset 157359 364bd220cdb7a0b4c8ab1f9ecfef2ef980160b80
parent 157358 e38d1e0ed82a274b30e9a7af391dcd640d167bf6
child 157360 792f3433ded5786fa264eba68780c63ea2dea084
child 157421 53d55d2d0a25282cca238e6df17b68b3513f9430
push id36692
push userryanvm@gmail.com
push dateMon, 25 Nov 2013 14:58:23 +0000
treeherdermozilla-inbound@364bd220cdb7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersDRC
bugs891693
milestone28.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 891693 - Make sure that huffval gets zeroed before use. r=DRC
media/libjpeg/jdmarker.c
--- a/media/libjpeg/jdmarker.c
+++ b/media/libjpeg/jdmarker.c
@@ -467,16 +467,18 @@ get_dht (j_decompress_ptr cinfo)
      * off the end of our table space.  jdhuff.c will check more carefully.
      */
     if (count > 256 || ((INT32) count) > length)
       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
 
     for (i = 0; i < count; i++)
       INPUT_BYTE(cinfo, huffval[i], return FALSE);
 
+    MEMZERO(&huffval[count], (256-count)*SIZEOF(UINT8));
+
     length -= count;
 
     if (index & 0x10) {		/* AC table definition */
       index -= 0x10;
       htblptr = &cinfo->ac_huff_tbl_ptrs[index];
     } else {			/* DC table definition */
       htblptr = &cinfo->dc_huff_tbl_ptrs[index];
     }