From: DRC <dcommander@users.sourceforge.net>
Date: Tue, 3 Aug 2010 19:16:55 +0000 (+0000)
Subject: Handle erroneous Huffman codes
X-Git-Tag: v1.0.90~199
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=d4dda31a532ca1cebfe5f518dc3d738a8d8df7e0;p=tigervnc.git

Handle erroneous Huffman codes


git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4115 3789f03b-4d11-0410-bbf8-ca57d06f2519
---

diff --git a/common/jpeg/jdhuff.c b/common/jpeg/jdhuff.c
index cbab592e..04b38d5d 100644
--- a/common/jpeg/jdhuff.c
+++ b/common/jpeg/jdhuff.c
@@ -16,7 +16,7 @@
 
 /* Modifications:
  * Copyright (C)2007 Sun Microsystems, Inc.
- * Copyright (C)2009 D. R. Commander
+ * Copyright (C)2009-2010 D. R. Commander
  *
  * This library is free software and may be redistributed and/or modified under
  * the terms of the wxWindows Library License, Version 3.1 or (at your option)
@@ -240,6 +240,7 @@ jpeg_make_d_derived_tbl (j_decompress_ptr cinfo, boolean isDC, int tblno,
       dtbl->maxcode[l] = -1;	/* -1 if no codes of this length */
     }
   }
+  dtbl->valoffset[17] = 0;
   dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
 
   /* Compute lookahead tables to speed up decoding.
diff --git a/common/jpeg/jdhuff.h b/common/jpeg/jdhuff.h
index 0a242c5e..2697488f 100644
--- a/common/jpeg/jdhuff.h
+++ b/common/jpeg/jdhuff.h
@@ -2,6 +2,7 @@
  * jdhuff.h
  *
  * Copyright (C) 1991-1997, Thomas G. Lane.
+ * Copyright (C) 2010, D. R. Commander.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
@@ -27,7 +28,7 @@ typedef struct {
   /* Basic tables: (element [0] of each array is unused) */
   INT32 maxcode[18];		/* largest code of length k (-1 if none) */
   /* (maxcode[17] is a sentinel to ensure jpeg_huff_decode terminates) */
-  INT32 valoffset[17];		/* huffval[] offset for codes of length k */
+  INT32 valoffset[18];		/* huffval[] offset for codes of length k */
   /* valoffset[k] = huffval[] index of 1st symbol of code length k, less
    * the smallest code of length k; so given a code of length k, the
    * corresponding symbol is huffval[code + valoffset[k]]