Handle erroneous Huffman codes

git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4115 3789f03b-4d11-0410-bbf8-ca57d06f2519

diff --git a/common/jpeg/jdhuff.c b/common/jpeg/jdhuff.c
index cbab592e5ced73597794d7b1e8ab51abfc3d2294..04b38d5d462cd3ce751b97e8b32c6450fe10eeb7 100644 (file)
--- a/common/jpeg/jdhuff.c
+++ b/common/jpeg/jdhuff.c
@@ -16,7 +16,7 @@
 
 /* Modifications:
  * Copyright (C)2007 Sun Microsystems, Inc.
- * Copyright (C)2009 D. R. Commander
+ * Copyright (C)2009-2010 D. R. Commander
  *
  * This library is free software and may be redistributed and/or modified under
  * the terms of the wxWindows Library License, Version 3.1 or (at your option)
@@ -240,6 +240,7 @@ jpeg_make_d_derived_tbl (j_decompress_ptr cinfo, boolean isDC, int tblno,
       dtbl->maxcode[l] = -1;   /* -1 if no codes of this length */
     }
   }
+  dtbl->valoffset[17] = 0;
   dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
 
   /* Compute lookahead tables to speed up decoding.

diff --git a/common/jpeg/jdhuff.h b/common/jpeg/jdhuff.h
index 0a242c5ec74736f4512a44332331a33b59e61bf4..2697488f997e96404c063e20fa9ea6bc864aa715 100644 (file)
--- a/common/jpeg/jdhuff.h
+++ b/common/jpeg/jdhuff.h
@@ -2,6 +2,7 @@
  * jdhuff.h
  *
  * Copyright (C) 1991-1997, Thomas G. Lane.
+ * Copyright (C) 2010, D. R. Commander.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
@@ -27,7 +28,7 @@ typedef struct {
   /* Basic tables: (element [0] of each array is unused) */
   INT32 maxcode[18];           /* largest code of length k (-1 if none) */
   /* (maxcode[17] is a sentinel to ensure jpeg_huff_decode terminates) */
-  INT32 valoffset[17];         /* huffval[] offset for codes of length k */
+  INT32 valoffset[18];         /* huffval[] offset for codes of length k */
   /* valoffset[k] = huffval[] index of 1st symbol of code length k, less
    * the smallest code of length k; so given a code of length k, the
    * corresponding symbol is huffval[code + valoffset[k]]