commit e2327c0fdaa6763990845e619f65cd6c60619251
author Leon Scroggins III <scroggo@google.com> Tue Jan 03 11:02:03 2017 -0500
committer Leon Scroggins III <scroggo@google.com> Tue Jan 03 11:02:03 2017 -0500
tree b98d14ee395e6207c1fae8b045cc801d4aeb000e
parent 9cb68a081ceac978564b5f20b2f08b415f02fc4a

Fix out of bounds memory read in GIFMovie.cpp

Test: TODO (to be separately uploaded to CTS)

When decoding a GIF image, do not attempt to copy an index if it is out
of range.

BUG:33897722
Change-Id: I8c8ca69b00bf1f655e62bbe1798b9a47bf6699be

core/jni/android/graphics/GIFMovie.cpp

diff --git a/core/jni/android/graphics/GIFMovie.cpp b/core/jni/android/graphics/GIFMovie.cpp
index 035417e..92c7746 100644
--- a/core/jni/android/graphics/GIFMovie.cpp
+++ b/core/jni/android/graphics/GIFMovie.cpp
@@ -121,7 +121,7 @@
                      int transparent, int width)
 {
     for (; width > 0; width--, src++, dst++) {
-        if (*src != transparent) {
+        if (*src != transparent && *src < cmap->ColorCount) {
             const GifColorType& col = cmap->Colors[*src];
             *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue);
         }