Fixing possible out of bound memory access
This was a bug found by ASAN. When width is very small, we can have something like width == 1 and rowBytes == 8. Using "2 * yWidth" (2) would be smaller than rowBytesY (8), so we could read memory out of bounds. This issue has a separate fix in blink (crbug.com/458861).
BUG=skia:
Review URL: https://codereview.chromium.org/936133003
diff --git a/src/images/SkImageDecoder_libjpeg.cpp b/src/images/SkImageDecoder_libjpeg.cpp
index 3c93e61..d32e2a2 100644
--- a/src/images/SkImageDecoder_libjpeg.cpp
+++ b/src/images/SkImageDecoder_libjpeg.cpp
@@ -798,11 +798,11 @@
size_t rowBytesV = rowBytes[2];
int yScanlinesToRead = DCTSIZE * v;
- SkAutoMalloc lastRowStorage(yWidth * 8);
+ SkAutoMalloc lastRowStorage(rowBytesY * 4);
JSAMPROW yLastRow = (JSAMPROW)lastRowStorage.get();
- JSAMPROW uLastRow = yLastRow + 2 * yWidth;
- JSAMPROW vLastRow = uLastRow + 2 * yWidth;
- JSAMPROW dummyRow = vLastRow + 2 * yWidth;
+ JSAMPROW uLastRow = yLastRow + rowBytesY;
+ JSAMPROW vLastRow = uLastRow + rowBytesY;
+ JSAMPROW dummyRow = vLastRow + rowBytesY;
while (cinfo.output_scanline < cinfo.output_height) {
// Request 8 or 16 scanlines: returns 0 or more scanlines.