tree 5cd6a86675039172b645138f34dccfefeb07ec8c
parent ccaba5d7894ecfb5a8f11e48d3f86e1f14d5a469
author DRC <information@libjpeg-turbo.org> 1606567107 -0600
committer DRC <information@libjpeg-turbo.org> 1606568768 -0600

Fix uninitialized read in decompress_smooth_data()

Regression introduced by 42825b68d570fb07fe820ac62ad91017e61e9a25

Referring to the discussion in #459, the OSS-Fuzz test case
https://github.com/libjpeg-turbo/libjpeg-turbo/files/5597075/clusterfuzz-testcase-minimized-pngsave_buffer_fuzzer-5728375846731776.txt
created a situation in which
  cinfo->output_iMCU_row > cinfo->master->last_good_iMCU_row
but
  cinfo->input_scan_number == 1
thus causing decompress_smooth_data() to read from
prev_coef_bits_latch[], which was uninitialized.  I was unable to create
the same situation with a real JPEG image.