Merge branch '1.4.x'

nvdla · Mar 6, 2016 · b3247c7 · b3247c7
2 parents 7cb8de4 + a572622
commit b3247c7
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/ChangeLog.txt b/ChangeLog.txt
@@ -1,3 +1,10 @@
+1.5.0
+=====
+
+[1] Fixed an issue whereby a malformed motion-JPEG frame could cause the "fast
+path" of libjpeg-turbo's Huffman decoder to read from uninitialized memory.
+
+
 1.5 beta1
 =========
 

diff --git a/jstdhuff.c b/jstdhuff.c
@@ -42,6 +42,7 @@ add_huff_table (j_common_ptr cinfo,
     ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
 
   MEMCOPY((*htblptr)->huffval, val, nsymbols * sizeof(UINT8));
+  MEMZERO(&((*htblptr)->huffval[nsymbols]), (256 - nsymbols) * sizeof(UINT8));
 
   /* Initialize sent_table FALSE so table will be written to JPEG file. */
   (*htblptr)->sent_table = FALSE;