tree ad9de413437275d6f98d0fd17eafae2658615c90
parent cfc7e6e58e9a187aba9312c28f8245052919212b
author DRC <information@libjpeg-turbo.org> 1606337755 -0600
committer DRC <information@libjpeg-turbo.org> 1606338508 -0600

Fix buffer overrun with certain narrow prog JPEGs

Regression introduced by 6d91e950c871103a11bac2f10c63bf998796c719

last_block_column in decompress_smooth_data() can be 0 if, for instance,
decompressing a 4:4:4 image of width 8 or less or a 4:2:2 or 4:2:0 image
of width 16 or less.  Since last_block_column is an unsigned int,
subtracting 1 from it produced 0xFFFFFFFF, the test in line 590 passed,
and we attempted to access blocks from a second block column that didn't
actually exist.

Closes #476