Handle erroneous Huffman codes
git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/trunk@4115 3789f03b-4d11-0410-bbf8-ca57d06f2519
diff --git a/common/jpeg/jdhuff.c b/common/jpeg/jdhuff.c
index cbab592..04b38d5 100644
--- a/common/jpeg/jdhuff.c
+++ b/common/jpeg/jdhuff.c
@@ -16,7 +16,7 @@
/* Modifications:
* Copyright (C)2007 Sun Microsystems, Inc.
- * Copyright (C)2009 D. R. Commander
+ * Copyright (C)2009-2010 D. R. Commander
*
* This library is free software and may be redistributed and/or modified under
* the terms of the wxWindows Library License, Version 3.1 or (at your option)
@@ -240,6 +240,7 @@
dtbl->maxcode[l] = -1; /* -1 if no codes of this length */
}
}
+ dtbl->valoffset[17] = 0;
dtbl->maxcode[17] = 0xFFFFFL; /* ensures jpeg_huff_decode terminates */
/* Compute lookahead tables to speed up decoding.
diff --git a/common/jpeg/jdhuff.h b/common/jpeg/jdhuff.h
index 0a242c5..2697488 100644
--- a/common/jpeg/jdhuff.h
+++ b/common/jpeg/jdhuff.h
@@ -2,6 +2,7 @@
* jdhuff.h
*
* Copyright (C) 1991-1997, Thomas G. Lane.
+ * Copyright (C) 2010, D. R. Commander.
* This file is part of the Independent JPEG Group's software.
* For conditions of distribution and use, see the accompanying README file.
*
@@ -27,7 +28,7 @@
/* Basic tables: (element [0] of each array is unused) */
INT32 maxcode[18]; /* largest code of length k (-1 if none) */
/* (maxcode[17] is a sentinel to ensure jpeg_huff_decode terminates) */
- INT32 valoffset[17]; /* huffval[] offset for codes of length k */
+ INT32 valoffset[18]; /* huffval[] offset for codes of length k */
/* valoffset[k] = huffval[] index of 1st symbol of code length k, less
* the smallest code of length k; so given a code of length k, the
* corresponding symbol is huffval[code + valoffset[k]]