commit 62f48dbb7eb018c721c3a14f0d0f03395bced54a
author Chris Craik <ccraik@google.com> Tue Oct 18 10:17:41 2016 -0700
committer Ted Meyer <tmathmeyer@google.com> Fri Oct 21 11:04:11 2016 +0000
tree d3e738bbbd0354b0353e791f778bdae0b6fe490f
parent 8d069cf9807027f7b3148589292f8f0544179ebf

Handle color bounds correctly in GIF decode.

Bug: 31631842
Change-Id: Ia4d25d9cd440286366f82433d3ff227384c0572f
(cherry picked from commit 0ada9456d0270cb0e357a43d9187a6418d770760)

framesequence/jni/FrameSequence_gif.cpp

diff --git a/framesequence/jni/FrameSequence_gif.cpp b/framesequence/jni/FrameSequence_gif.cpp
index 2188c53..e658425 100644
--- a/framesequence/jni/FrameSequence_gif.cpp
+++ b/framesequence/jni/FrameSequence_gif.cpp
@@ -157,7 +157,7 @@
 static void copyLine(Color8888* dst, const unsigned char* src, const ColorMapObject* cmap,
                      int transparent, int width) {
     for (; width > 0; width--, src++, dst++) {
-        if (*src != transparent) {
+        if (*src != transparent && *src < cmap->ColorCount) {
             *dst = gifColorToColor8888(cmap->Colors[*src]);
         }
     }