Fixing possible out of bound memory access

src/images/SkImageDecoder_libjpeg.cpp

 /*
  * Copyright 2007 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkImageDecoder.h"
 #include "SkImageEncoder.h"
@@ skipping 780 matching lines @@
     int v = cinfo.cur_comp_info[0]->v_samp_factor;
     int uvMaxH = uvSize.height() - 1;
     JSAMPROW outputY = static_cast<JSAMPROW>(planes[0]);
     JSAMPROW outputU = static_cast<JSAMPROW>(planes[1]);
     JSAMPROW outputV = static_cast<JSAMPROW>(planes[2]);
     size_t rowBytesY = rowBytes[0];
     size_t rowBytesU = rowBytes[1];
     size_t rowBytesV = rowBytes[2];
 
     int yScanlinesToRead = DCTSIZE * v;
-    SkAutoMalloc lastRowStorage(yWidth * 8);
+    SkAutoMalloc lastRowStorage(rowBytesY * 4);
     JSAMPROW yLastRow = (JSAMPROW)lastRowStorage.get();
-    JSAMPROW uLastRow = yLastRow + 2 * yWidth;
-    JSAMPROW vLastRow = uLastRow + 2 * yWidth;
-    JSAMPROW dummyRow = vLastRow + 2 * yWidth;
+    JSAMPROW uLastRow = yLastRow + rowBytesY;
+    JSAMPROW vLastRow = uLastRow + rowBytesY;
+    JSAMPROW dummyRow = vLastRow + rowBytesY;
 
     while (cinfo.output_scanline < cinfo.output_height) {
         // Request 8 or 16 scanlines: returns 0 or more scanlines.
         bool hasYLastRow(false), hasUVLastRow(false);
         // Assign 8 or 16 rows of memory to read the Y channel.
         for (int i = 0; i < yScanlinesToRead; ++i) {
             int scanline = (cinfo.output_scanline + i);
             if (scanline < yMaxH) {
                 bufferraw2[i] = &outputY[scanline * rowBytesY];
             } else if (scanline == yMaxH) {
@@ skipping 629 matching lines @@
     return SkImageDecoder::kUnknown_Format;
 }
 
 static SkImageEncoder* sk_libjpeg_efactory(SkImageEncoder::Type t) {
     return (SkImageEncoder::kJPEG_Type == t) ? SkNEW(SkJPEGImageEncoder) : NULL;
 }
 
 static SkImageDecoder_DecodeReg gDReg(sk_libjpeg_dfactory);
 static SkImageDecoder_FormatReg gFormatReg(get_format_jpeg);
 static SkImageEncoder_EncodeReg gEReg(sk_libjpeg_efactory);