commit e6f0343d5a8754e8cd0fbe6f8f120187b28a636e
author Jorim Jaggi <jjaggi@google.com> Tue Nov 29 13:12:48 2016 +0100
committer gitbuildkicker <android-build@google.com> Mon Dec 19 16:16:51 2016 -0800
tree e5c19c26fc748743c3956d06a2c0492610f9c3c4
parent 334959c9b0415648a48de8cd4514f10aaa60ebe4

Fix security vulnerability

Change-Id: I19028233d2ce79ef08947f00d2ecba20312579cc
Fixes: 32769670
(cherry picked from commit 28d83109cba8e1949032c78465649ba21db2d22e)
(cherry picked from commit 890381c983b6eca60a435ebf5a4bdbd7a32660f0)

gdx/jni/gdx2d/jpgd.cpp

diff --git a/gdx/jni/gdx2d/jpgd.cpp b/gdx/jni/gdx2d/jpgd.cpp
index 3873dfb..4c84a33 100644
--- a/gdx/jni/gdx2d/jpgd.cpp
+++ b/gdx/jni/gdx2d/jpgd.cpp
@@ -2231,7 +2231,10 @@
   for (l = 1; l <= 16; l++)
   {
     for (i = 1; i <= m_huff_num[index][l]; i++)
+    {
+      JPGD_ASSERT(p < 257);
       huffsize[p++] = static_cast<uint8>(l);
+    }
   }
 
   huffsize[p] = 0;
@@ -2246,6 +2249,7 @@
   {
     while (huffsize[p] == si)
     {
+      JPGD_ASSERT(p < 257);
       huffcode[p++] = code;
       code++;
     }