Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2327c0f authored by Leon Scroggins III's avatar Leon Scroggins III
Browse files

Fix out of bounds memory read in GIFMovie.cpp 

Test: TODO (to be separately uploaded to CTS)

When decoding a GIF image, do not attempt to copy an index if it is out
of range.

BUG:33897722
Change-Id: I8c8ca69b00bf1f655e62bbe1798b9a47bf6699be
parent 9cb68a08

core/jni/android/graphics/GIFMovie.cpp

+1 −1
Original line number Diff line number Diff line
@@ -121,7 +121,7 @@ static void copyLine(uint32_t* dst, const unsigned char* src, const ColorMapObje 
                     int transparent, int width)

{

    for (; width > 0; width--, src++, dst++) {

        if (*src != transparent) {

        if (*src != transparent && *src < cmap->ColorCount) {

            const GifColorType& col = cmap->Colors[*src];

            *dst = SkPackARGB32(0xFF, col.Red, col.Green, col.Blue);

        }