From e2327c0fdaa6763990845e619f65cd6c60619251 Mon Sep 17 00:00:00 2001 From: Leon Scroggins III Date: Tue, 3 Jan 2017 11:02:03 -0500 Subject: [PATCH] Fix out of bounds memory read in GIFMovie.cpp Test: TODO (to be separately uploaded to CTS) When decoding a GIF image, do not attempt to copy an index if it is out of range. BUG:33897722 Change-Id: I8c8ca69b00bf1f655e62bbe1798b9a47bf6699be --- core/jni/android/graphics/GIFMovie.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/jni/android/graphics/GIFMovie.cpp b/core/jni/android/graphics/GIFMovie.cpp index 035417e66592a..92c774643a3ab 100644 --- a/core/jni/android/graphics/GIFMovie.cpp +++ b/core/jni/android/graphics/GIFMovie.cpp @@ -121,7 +121,7 @@ static void copyLine(uint32_t* dst, const unsigned char* src, const ColorMapObje int transparent, int width) { for (; width > 0; width--, src++, dst++) { - if (*src != transparent) { + if (*src != transparent && *src < cmap->ColorCount) { const GifColorType& col = cmap->Colors[*src]; *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue); }