commit a2ad8ea2565cc1844335541d21df3640db54edab
author Chris Craik <ccraik@google.com> Thu Feb 08 15:58:34 2018 -0800
committer JP Sugarbroad <jpsugar@google.com> Tue Feb 13 14:33:22 2018 -0800
tree ca6d77dc34d13cf5d7f1a4ee93f5686d48804c34
parent 9baf8cebd505f9683a0c3690a57669ef2ce385e1

Add bounds checking for transparency lookup

Bug: 71361451
Test: manual test with sample app

Change-Id: Icaa626cfc93115fe1cc2f42040b396c2318bb6e4
(cherry picked from commit 53f97a2dd69b5b74e0fae2108ebab9276760aa47)

framesequence/jni/FrameSequence_gif.cpp

diff --git a/framesequence/jni/FrameSequence_gif.cpp b/framesequence/jni/FrameSequence_gif.cpp
index 3ba09dc..ed47834 100644
--- a/framesequence/jni/FrameSequence_gif.cpp
+++ b/framesequence/jni/FrameSequence_gif.cpp
@@ -111,12 +111,14 @@
     }
 #endif
 
-    if (mGif->SColorMap) {
+    const ColorMapObject* cmap = mGif->SColorMap;
+    if (cmap) {
         // calculate bg color
         GraphicsControlBlock gcb;
         DGifSavedExtensionToGCB(mGif, 0, &gcb);
-        if (gcb.TransparentColor == NO_TRANSPARENT_COLOR) {
-            mBgColor = gifColorToColor8888(mGif->SColorMap->Colors[mGif->SBackGroundColor]);
+        if (gcb.TransparentColor == NO_TRANSPARENT_COLOR
+                && mGif->SBackGroundColor < cmap->ColorCount) {
+            mBgColor = gifColorToColor8888(cmap->Colors[mGif->SBackGroundColor]);
         }
     }
 }
@@ -358,4 +360,3 @@
         acceptsBuffers,
 };
 static Registry gRegister(gEntry);
-