Merge "Fix out of bounds memory read in GIFMovie.cpp"

2017-01-03 18:17:58 +00:00
parent 16ea7f7640 e2327c0fda
commit dc143e01cc
1 changed files with 1 additions and 1 deletions
--- a/core/jni/android/graphics/GIFMovie.cpp
+++ b/core/jni/android/graphics/GIFMovie.cpp
@@ -121,7 +121,7 @@ static void copyLine(uint32_t* dst, const unsigned char* src, const ColorMapObje
                     int transparent, int width)
 {
    for (; width > 0; width--, src++, dst++) {
-        if (*src != transparent) {
+        if (*src != transparent && *src < cmap->ColorCount) {
            const GifColorType& col = cmap->Colors[*src];
            *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue);
        }