Cherry-pick a fix from r324 of the libjpeg-turbo stable branch that...

jdhuff.c

 /*
  * jdhuff.c
  *
  * Copyright (C) 1991-1997, Thomas G. Lane.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
  * This file contains Huffman entropy decoding routines.
  *
  * Much of the complexity here has to do with supporting input suspension.
@@ skipping 640 matching lines @@
   size = symbol >> 8; \
   bits_left -= size; \
   symbol = symbol & ((1 << HUFF_LOOKAHEAD) - 1); \
   if (size == HUFF_LOOKAHEAD + 1) { \
     symbol = (get_buffer >> bits_left) & ((1 << (size)) - 1); \
     while (symbol > htbl->maxcode[size]) { \
       symbol <<= 1; \
       symbol |= GET_BITS(1); \
       size++; \
     } \
-    symbol = htbl->pub->huffval[ (int) (symbol + htbl->valoffset[size]) ]; \
+    symbol = htbl->pub->huffval[ (int) (symbol + htbl->valoffset[size]) & 0xFF ]; \
   } \
 }
 
 /***************************************************************/
 
 LOCAL(boolean)
 decode_mcu_fast (j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
 {
   huff_entropy_ptr entropy = (huff_entropy_ptr) cinfo->entropy;
   BITREAD_STATE_VARS;
@@ skipping 143 matching lines @@
                                 SIZEOF(huff_entropy_decoder));
   cinfo->entropy = (struct jpeg_entropy_decoder *) entropy;
   entropy->pub.start_pass = start_pass_huff_decoder;
   entropy->pub.decode_mcu = decode_mcu;
 
   /* Mark tables unallocated */
   for (i = 0; i < NUM_HUFF_TBLS; i++) {
     entropy->dc_derived_tbls[i] = entropy->ac_derived_tbls[i] = NULL;
   }
 }