diff options
| author | tnagel@chromium.org <tnagel@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-08-06 22:54:13 +0000 |
|---|---|---|
| committer | tnagel@chromium.org <tnagel@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2014-08-06 22:54:13 +0000 |
| commit | 2bb5a856f69e91ddfc03642f760fc435d646e451 (patch) | |
| tree | 2f10f6335a4066c780536bff7aec0bed67abce09 /chrome/utility | |
| parent | fe758c03e87c889544cf7501622e1ffa3f0f3719 (diff) | |
| download | chromium_src-2bb5a856f69e91ddfc03642f760fc435d646e451.zip chromium_src-2bb5a856f69e91ddfc03642f760fc435d646e451.tar.gz chromium_src-2bb5a856f69e91ddfc03642f760fc435d646e451.tar.bz2 | |
Fix invalid array access in OnRobustJPEGDecodeImage().
This doesn't seem to be a problem for release builds, but in debug builds the invalid array access causes STL errors:
error: attempt to subscript container with out-of-bounds index 0, but
container only holds 0 elements.
BUG=401161
Review URL: https://codereview.chromium.org/446853002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@287884 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/utility')
| -rw-r--r-- | chrome/utility/chrome_content_utility_client.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/chrome/utility/chrome_content_utility_client.cc b/chrome/utility/chrome_content_utility_client.cc index 4f7b8fe..6225143 100644 --- a/chrome/utility/chrome_content_utility_client.cc +++ b/chrome/utility/chrome_content_utility_client.cc @@ -232,7 +232,8 @@ void ChromeContentUtilityClient::OnCreateZipFile( void ChromeContentUtilityClient::OnRobustJPEGDecodeImage( const std::vector<unsigned char>& encoded_data) { // Our robust jpeg decoding is using IJG libjpeg. - if (gfx::JPEGCodec::JpegLibraryVariant() == gfx::JPEGCodec::IJG_LIBJPEG) { + if (gfx::JPEGCodec::JpegLibraryVariant() == gfx::JPEGCodec::IJG_LIBJPEG && + !encoded_data.empty()) { scoped_ptr<SkBitmap> decoded_image(gfx::JPEGCodec::Decode( &encoded_data[0], encoded_data.size())); if (!decoded_image.get() || decoded_image->empty()) { |