Bug 891693 - Make sure that huffval gets zeroed before use. r=DRC, a=lsblakk
authorMichael Zalewski <lcamtuf@coredump.cx>
Thu, 21 Nov 2013 10:48:32 -0500
changeset 119965 617eb9d9bcc23f80ed8059474c37ed412617cb18
parent 119964 c699a8e7bde911125c271e9fdcb5d35990772b83
child 119966 c714e1bd607f8cae6ee6ef89f5bd2587a97649be
push id1101
push userryanvm@gmail.com
push dateMon, 25 Nov 2013 21:24:19 +0000
reviewersDRC, lsblakk
bugs891693
milestone18.1
Bug 891693 - Make sure that huffval gets zeroed before use. r=DRC, a=lsblakk CLOSED TREE
media/libjpeg/jdmarker.c
--- a/media/libjpeg/jdmarker.c
+++ b/media/libjpeg/jdmarker.c
@@ -466,16 +466,18 @@ get_dht (j_decompress_ptr cinfo)
      * off the end of our table space.  jdhuff.c will check more carefully.
      */
     if (count > 256 || ((INT32) count) > length)
       ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
 
     for (i = 0; i < count; i++)
       INPUT_BYTE(cinfo, huffval[i], return FALSE);
 
+    MEMZERO(&huffval[count], (256 - count) * SIZEOF(UINT8));
+
     length -= count;
 
     if (index & 0x10) {		/* AC table definition */
       index -= 0x10;
       htblptr = &cinfo->ac_huff_tbl_ptrs[index];
     } else {			/* DC table definition */
       htblptr = &cinfo->dc_huff_tbl_ptrs[index];
     }