commit 49aedf4231e843b9d2ef1bf5221e9c6ec7081c90
author DRC <dcommander@users.sourceforge.net> Tue Jan 04 08:09:41 2011 +0000
committer DRC <dcommander@users.sourceforge.net> Tue Jan 04 08:09:41 2011 +0000
tree 72eb6c8879985b8bb25e4c3b980aa6cd7813e004
parent 190d5495fe41ad0ec26ca702c66ff5c5f606079b
parent fa1d18385d904d530b4aec83ab7757a33397de6e

Further protect against invalid Huffman codes


git-svn-id: svn+ssh://svn.code.sf.net/p/libjpeg-turbo/code/trunk@314 632fc199-4ca6-4c93-a231-07263d6284db

ChangeLog.txt

diff --git a/ChangeLog.txt b/ChangeLog.txt
index 519e430..9fcb283 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -27,6 +27,8 @@
 [9] Added an extended version of tjDecompressHeader() to TurboJPEG/OSS which
 allows the caller to determine the type of subsampling used in a JPEG image.
 
+[10] Added further protections against invalid Huffman codes.
+
 
 Significant changes since 1.0.0
 ===============================

jdhuff.c

diff --git a/jdhuff.c b/jdhuff.c
index ab8e254..58e3779 100644
--- a/jdhuff.c
+++ b/jdhuff.c
@@ -660,7 +660,7 @@
       symbol |= GET_BITS(1); \
       size++; \
     } \
-    symbol = htbl->pub->huffval[ (int) (symbol + htbl->valoffset[size]) ]; \
+    symbol = htbl->pub->huffval[ (int) (symbol + htbl->valoffset[size]) & 0xFF ]; \
   } \
 }