Merge 132961 (merge bug: http://crbug.com/158840) - Fix potential overflow in jpeg exif reader. Fou…

Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp

Index: Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
===================================================================
--- Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp	(revision 133084)
+++ Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp	(working copy)
@@ -187,7 +187,10 @@
         unsigned ifdOffset;
         if (!checkExifHeader(marker, isBigEndian, ifdOffset))
             continue;
-        ifdOffset += 6; // Account for 'Exif\0<fill byte>' header.
+        const unsigned offsetToTiffData = 6; // Account for 'Exif\0<fill byte>' header.
+        if (marker->data_length < offsetToTiffData || ifdOffset >= marker->data_length - offsetToTiffData)
+            continue;
+        ifdOffset += offsetToTiffData;
 
         // The jpeg exif container format contains a tiff block for metadata.
         // A tiff image file directory (ifd) consists of a uint16_t describing