commit 9f00add2fb5aaa4afc9bf984c9e7feb2d1b34a5f
author Tom Taylor <tomtaylor@google.com> Tue Jan 17 19:44:53 2017 +0000
committer android-build-merger <android-build-merger@google.com> Tue Jan 17 19:44:53 2017 +0000
tree 2a625674ae815523f077fd397d88b306e7f7b971
parent b44b56b7798226299d76b967a957c6f9a0063ced
parent 6f763fef7ab16e28f6c43496e0f866e7803b4dc8

32764144 Security Vulnerability - heap buffer overflow in libgiftranscode.so in colorMap->Colors[colorIndex]
am: 6f763fef7a

Change-Id: Ia34564714e00734976099b95594b6ea6501894b9

jni/GifTranscoder.cpp

diff --git a/jni/GifTranscoder.cpp b/jni/GifTranscoder.cpp
index 81f3f75..0e83982 100644
--- a/jni/GifTranscoder.cpp
+++ b/jni/GifTranscoder.cpp
@@ -384,6 +384,11 @@
     for (int y = 0; y < gifIn->Image.Height; y++) {
         for (int x = 0; x < gifIn->Image.Width; x++) {
             GifByteType colorIndex = *getPixel(rasterBits, gifIn->Image.Width, x, y);
+            if (colorIndex >= colorMap->ColorCount) {
+                LOGE("Color Index %d is out of bounds (count=%d)", colorIndex,
+                    colorMap->ColorCount);
+                return false;
+            }
 
             // This image may be smaller than the GIF's "logical screen"
             int renderX = x + gifIn->Image.Left;