Merge 132961 (merge bug: http://crbug.com/158840) - Fix potential overflow in jpeg exif reader. Fou…

Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp

 /*
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * Portions are Copyright (C) 2001-6 mozilla.org
  *
  * Other contributors:
  *   Stuart Parmenter <stuart@mozilla.com>
  *
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
@@ skipping 169 matching lines @@
 {
     // The JPEG decoder looks at EXIF metadata.
     // FIXME: Possibly implement XMP and IPTC support.
     const unsigned orientationTag = 0x112;
     const unsigned shortType = 3;
     for (jpeg_saved_marker_ptr marker = info->marker_list; marker; marker = marker->next) {
         bool isBigEndian;
         unsigned ifdOffset;
         if (!checkExifHeader(marker, isBigEndian, ifdOffset))
             continue;
-        ifdOffset += 6; // Account for 'Exif\0<fill byte>' header.
+        const unsigned offsetToTiffData = 6; // Account for 'Exif\0<fill byte>' header.
+        if (marker->data_length < offsetToTiffData || ifdOffset >= marker->data_length - offsetToTiffData)
+            continue;
+        ifdOffset += offsetToTiffData;
 
         // The jpeg exif container format contains a tiff block for metadata.
         // A tiff image file directory (ifd) consists of a uint16_t describing
         // the number of ifd entries, followed by that many entries.
         // When touching this code, it's useful to look at the tiff spec:
         // http://partners.adobe.com/public/developer/en/tiff/TIFF6.pdf
         JOCTET* ifd = marker->data + ifdOffset;
         JOCTET* end = marker->data + marker->data_length;
         if (end - ifd < 2)
             continue;
@@ skipping 554 matching lines @@
     // has failed.
     if (!m_reader->decode(*m_data, onlySize) && isAllDataReceived())
         setFailed();
     // If we're done decoding the image, we don't need the JPEGImageReader
     // anymore.  (If we failed, |m_reader| has already been cleared.)
     else if (!m_frameBufferCache.isEmpty() && (m_frameBufferCache[0].status() == ImageFrame::FrameComplete))
         m_reader.clear();
 }
 
 }