commit 270a480de087f11303416e82a91338ccdbdcda48
author Leon Scroggins III <scroggo@google.com> Tue Feb 07 16:55:24 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Feb 07 16:55:24 2017 +0000
tree 8843f141595107e8fe14f8f2400c16a829a114cc
parent c001dc1c87910d26fd6a299539554d1612cbc7de
parent f054eb2904724930a3d681c79d165359ff2f29ee

Fix out of bounds memory read in GIFMovie.cpp am: 16882f7212 am: d2456e3a12 am: ffc0958605 am: df18259ff1 am: c9b947def7 am: 09ad23b21e am: 716de6b276 am: d1fb426850 am: d80a31cff8 am: 8b8fbb1e9c
am: f054eb2904

Change-Id: I0aa38c136013329f93efb583556790c3a0ac33e3

src/images/SkMovie_gif.cpp

diff --git a/src/images/SkMovie_gif.cpp b/src/images/SkMovie_gif.cpp
index 1031079..b4d73a9 100644
--- a/src/images/SkMovie_gif.cpp
+++ b/src/images/SkMovie_gif.cpp
@@ -122,7 +122,7 @@
                      int transparent, int width)
 {
     for (; width > 0; width--, src++, dst++) {
-        if (*src != transparent) {
+        if (*src != transparent && *src < cmap->ColorCount) {
             const GifColorType& col = cmap->Colors[*src];
             *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue);
         }