commit b3247c7d718d18bf75cd941c3940e5562b22f5bb
author DRC <information@libjpeg-turbo.org> Sun Mar 06 08:33:02 2016 -0600
committer DRC <information@libjpeg-turbo.org> Sun Mar 06 08:34:00 2016 -0600
tree 45ee20b75ffe6d43ae441c61ba1fa03cef58b9d9
parent 7cb8de4ae0a21257ced2e4f34cb0e884f18b6bd0
parent a572622dd654305c86585724c2a1ea34e22c2103

Merge branch '1.4.x'

ChangeLog.txt

diff --git a/ChangeLog.txt b/ChangeLog.txt
index 4062c69..68df4c3 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -1,3 +1,10 @@
+1.5.0
+=====
+
+[1] Fixed an issue whereby a malformed motion-JPEG frame could cause the "fast
+path" of libjpeg-turbo's Huffman decoder to read from uninitialized memory.
+
+
 1.5 beta1
 =========
 

jstdhuff.c

diff --git a/jstdhuff.c b/jstdhuff.c
index cbdf61c..e202e8e 100644
--- a/jstdhuff.c
+++ b/jstdhuff.c
@@ -42,6 +42,7 @@
     ERREXIT(cinfo, JERR_BAD_HUFF_TABLE);
 
   MEMCOPY((*htblptr)->huffval, val, nsymbols * sizeof(UINT8));
+  MEMZERO(&((*htblptr)->huffval[nsymbols]), (256 - nsymbols) * sizeof(UINT8));
 
   /* Initialize sent_table FALSE so table will be written to JPEG file. */
   (*htblptr)->sent_table = FALSE;