Better handle SOS CSi values and order

Image SOS CSi markers should be distinct. Enforce that constraint when
reading multiple CSi values in get_sos().

TBR=darin@chromium.org
BUG=258723

Review URL: https://codereview.chromium.org/27117002

git-svn-id: http://src.chromium.org/svn/trunk/deps/third_party/libjpeg_turbo@228381 4ff67af0-8c30-449e-8e8b-ad334ec8d88c
diff --git a/README.chromium b/README.chromium
index 4efe1a1..50624cf 100644
--- a/README.chromium
+++ b/README.chromium
@@ -24,4 +24,5 @@
 * Supported motion-JPEG frames that do not have DHT markers.
 * Fixed valgrind errors.
 The 'google.patch' file represents our changes from the original
-libjpeg-turbo-1.2.
+libjpeg-turbo-1.2. With those applied, also patch in google.jdmarker.patch to
+better handle multiple SOS CSi values and their ordering.
diff --git a/google.jdmarker.patch b/google.jdmarker.patch
new file mode 100644
index 0000000..ffbe925
--- /dev/null
+++ b/google.jdmarker.patch
@@ -0,0 +1,17 @@
+diff --git a/jdmarker.c b/jdmarker.c
+index 0d5da67..b537cb0 100644
+--- a/jdmarker.c
++++ b/jdmarker.c
+@@ -347,6 +347,12 @@ get_sos (j_decompress_ptr cinfo)
+     
+     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
+ 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
++
++    /* This CSi (cc) should differ from the previous CSi */
++    for (ci = 0; ci < i; ci++) {
++      if (cinfo->cur_comp_info[ci] == compptr)
++        ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
++    }
+   }
+ 
+   /* Collect the additional scan parameters Ss, Se, Ah/Al. */
diff --git a/jdmarker.c b/jdmarker.c
index 0d5da67..b537cb0 100644
--- a/jdmarker.c
+++ b/jdmarker.c
@@ -347,6 +347,12 @@
     
     TRACEMS3(cinfo, 1, JTRC_SOS_COMPONENT, cc,
 	     compptr->dc_tbl_no, compptr->ac_tbl_no);
+
+    /* This CSi (cc) should differ from the previous CSi */
+    for (ci = 0; ci < i; ci++) {
+      if (cinfo->cur_comp_info[ci] == compptr)
+        ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
+    }
   }
 
   /* Collect the additional scan parameters Ss, Se, Ah/Al. */