commit 14b1f22f9304555a3fbe4724e79b3ee5b7826f19
author Leon Scroggins III <scroggo@google.com> Fri Feb 03 09:31:04 2017 -0500
committer gitbuildkicker <android-build@google.com> Tue Feb 21 16:13:34 2017 -0800
tree a28b1624fe6165faf03f4ad85b4dc4269a673835
parent 2f3c19aaebe00b48608cc879e7a86596ca1e255d

Fix out of bounds memory read in GIFMovie.cpp

Test: TODO (to be separately uploaded to CTS)

When decoding a GIF image, do not attempt to copy an index if it is out
of range.

BUG:33897722
Change-Id: I8c8ca69b00bf1f655e62bbe1798b9a47bf6699be
(cherry picked from commit 16882f721279a82a1c860ac689ce570b16fe26a0)

src/images/SkMovie_gif.cpp

diff --git a/src/images/SkMovie_gif.cpp b/src/images/SkMovie_gif.cpp
index 1031079..b4d73a9 100644
--- a/src/images/SkMovie_gif.cpp
+++ b/src/images/SkMovie_gif.cpp
@@ -122,7 +122,7 @@
                      int transparent, int width)
 {
     for (; width > 0; width--, src++, dst++) {
-        if (*src != transparent) {
+        if (*src != transparent && *src < cmap->ColorCount) {
             const GifColorType& col = cmap->Colors[*src];
             *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue);
         }