commit 68d7a2fbd3221e4c1d9a7cd47b06595c9da892c7
author Leon Scroggins III <scroggo@google.com> Fri Feb 03 09:31:04 2017 -0500
committer Teemu Hukkanen <teemu@fairphone.com> Sat Apr 22 17:02:37 2017 +0200
tree eb257c5c08e15e8e4be7c28a5a44d027c659942f
parent 913887489b4834bef82da0bdfdba820eb8c2d7cd

FPII-2930 :Information disclosure vulnerability in libskia CVE-2017-0559 A-33897722

Fix out of bounds memory read in GIFMovie.cpp

Test: TODO (to be separately uploaded to CTS)

When decoding a GIF image, do not attempt to copy an index if it is out
of range.

BUG:33897722
Change-Id: I8c8ca69b00bf1f655e62bbe1798b9a47bf6699be
(cherry picked from commit 16882f721279a82a1c860ac689ce570b16fe26a0)

src/images/SkMovie_gif.cpp

diff --git a/src/images/SkMovie_gif.cpp b/src/images/SkMovie_gif.cpp
index decefd5..9dedfc0 100644
--- a/src/images/SkMovie_gif.cpp
+++ b/src/images/SkMovie_gif.cpp
@@ -116,7 +116,7 @@
                      int transparent, int width)
 {
     for (; width > 0; width--, src++, dst++) {
-        if (*src != transparent) {
+        if (*src != transparent && *src < cmap->ColorCount) {
             const GifColorType& col = cmap->Colors[*src];
             *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue);
         }