Fix a NULL pointer crash in the CJBig2_Image copy constructor.

core/src/fxcodec/jbig2/JBig2_SddProc.cpp

Index: core/src/fxcodec/jbig2/JBig2_SddProc.cpp
diff --git a/core/src/fxcodec/jbig2/JBig2_SddProc.cpp b/core/src/fxcodec/jbig2/JBig2_SddProc.cpp
index 52aef2b37f0ffdafcd3c6d5f57d1a9fcb3c91fae..edfc0740035aa410d6d5d45d11bb3dfa1d17681f 100644
--- a/core/src/fxcodec/jbig2/JBig2_SddProc.cpp
+++ b/core/src/fxcodec/jbig2/JBig2_SddProc.cpp
@@ -266,7 +266,7 @@ CJBig2_SymbolDict* CJBig2_SDDProc::decode_Arith(
   for (I = 0; I < SDNUMINSYMS + SDNUMNEWSYMS; I++) {
     if (EXFLAGS[I] && J < SDNUMEXSYMS) {
       if (I < SDNUMINSYMS) {
-        pDict->AddImage(new CJBig2_Image(*SDINSYMS[I]));
+        pDict->AddImage(SDINSYMS[I] ? new CJBig2_Image(*SDINSYMS[I]) : nullptr);

[Lei Zhang, 2015/11/24 18:22:36]

These are consistent with the only other copy ctor usage at
core/src/fxcodec/jbig2/JBig2_SymbolDict.cpp:23.

       } else {
         pDict->AddImage(SDNEWSYMS[I - SDNUMINSYMS]);
       }
@@ -604,7 +604,7 @@ CJBig2_SymbolDict* CJBig2_SDDProc::decode_Huffman(
   for (I = 0; I < SDNUMINSYMS + SDNUMNEWSYMS; I++) {
     if (EXFLAGS[I] && J < SDNUMEXSYMS) {
       if (I < SDNUMINSYMS) {
-        pDict->AddImage(new CJBig2_Image(*SDINSYMS[I]));
+        pDict->AddImage(SDINSYMS[I] ? new CJBig2_Image(*SDINSYMS[I]) : nullptr);
       } else {
         pDict->AddImage(SDNEWSYMS[I - SDNUMINSYMS]);
       }