diff --git a/swfdec/jpeg/jpeg.c b/swfdec/jpeg/jpeg.c index ef895e4..fd22313 100644 --- a/swfdec/jpeg/jpeg.c +++ b/swfdec/jpeg/jpeg.c @@ -273,6 +273,11 @@ huffman_table_init_jpeg (JpegDecoder *decoder, HuffmanTable *table, JpegBits * b k = 0; for (i = 0; i < 16; i++) { for (j = 0; j < huffsize[i]; j++) { + /* Check if we are overflowing HuffmanTable.entries */ + if (table->len > 255) { + jpeg_decoder_error (decoder, "bad huffsize[] array"); + return -1; + } huffman_table_add (table, symbol, i + 1, jpeg_bits_get_u8 (bits)); n++; symbol++;