32322450 Security Vulnerability - heap buffer overflow in libgiftranscode.so

am: bcc1f62715 Change-Id: Ia790b66a2d7d26b53463ebb2ebae524a7b4155fc
2016-12-05 22:53:45 +00:00
parent 1bc276100f bcc1f62715
commit 5311a02e27
1 changed files with 5 additions and 0 deletions
--- a/jni/GifTranscoder.cpp
+++ b/jni/GifTranscoder.cpp
@@ -274,6 +274,11 @@ bool GifTranscoder::resizeBoxFilter(GifFileType* gifIn, GifFileType* gifOut) {
                    // matches what libframesequence (Rastermill) does.
                    if (imageIndex == 0 && gifIn->SColorMap) {
                        if (gcb.TransparentColor == NO_TRANSPARENT_COLOR) {
+                            if (gifIn->SBackGroundColor < 0 ||
+                                gifIn->SBackGroundColor >= gifIn->SColorMap->ColorCount) {
+                                LOGE("SBackGroundColor overflow");
+                                return false;
+                            }
                            GifColorType bgColorIndex =
                                    gifIn->SColorMap->Colors[gifIn->SBackGroundColor];
                            bgColor = gifColorToColorARGB(bgColorIndex);