tree 9b01025004edc0a10f9c750cc53d69f0d72691c9
parent 9c33e89a43fd316fb42a7134d34585eb04c60416
author stackexploit <stackexploit@gmail.com> 1474923295 -0700
committer Commit bot <commit-bot@chromium.org> 1474923296 -0700

Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t, m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx >= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ? &pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int type array PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org, thestig@chromium.org

Review-Url: https://codereview.chromium.org/2322903002