Fix invalid array access in OnRobustJPEGDecodeImage().

chrome/utility/chrome_content_utility_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/utility/chrome_content_utility_client.h"
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
 #include "base/time/time.h"
@@ skipping 214 matching lines @@
     Send(new ChromeUtilityHostMsg_CreateZipFile_Succeeded());
   else
     Send(new ChromeUtilityHostMsg_CreateZipFile_Failed());
   ReleaseProcessIfNeeded();
 }
 #endif  // defined(OS_CHROMEOS)
 
 void ChromeContentUtilityClient::OnRobustJPEGDecodeImage(
     const std::vector<unsigned char>& encoded_data) {
   // Our robust jpeg decoding is using IJG libjpeg.
-  if (gfx::JPEGCodec::JpegLibraryVariant() == gfx::JPEGCodec::IJG_LIBJPEG) {
+  if (gfx::JPEGCodec::JpegLibraryVariant() == gfx::JPEGCodec::IJG_LIBJPEG &&
+      !encoded_data.empty()) {
     scoped_ptr<SkBitmap> decoded_image(gfx::JPEGCodec::Decode(
         &encoded_data[0], encoded_data.size()));
     if (!decoded_image.get() || decoded_image->empty()) {
       Send(new ChromeUtilityHostMsg_DecodeImage_Failed());
     } else {
       Send(new ChromeUtilityHostMsg_DecodeImage_Succeeded(*decoded_image));
     }
   } else {
     Send(new ChromeUtilityHostMsg_DecodeImage_Failed());
   }
@@ skipping 55 matching lines @@
     const std::string& mime_type, int64 total_size, bool get_attached_images) {
   // Only one IPCDataSource may be created and added to the list of handlers.
   metadata::IPCDataSource* source = new metadata::IPCDataSource(total_size);
   handlers_.push_back(source);
 
   metadata::MediaMetadataParser* parser = new metadata::MediaMetadataParser(
       source, mime_type, get_attached_images);
   parser->Start(base::Bind(&FinishParseMediaMetadata, base::Owned(parser)));
 }
 #endif