From d3243530d709296231a6e29d9047c5692c5fddc3 Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@gmx.de>
Date: Tue, 29 May 2012 17:53:49 +0200
Subject: [PATCH] jpg: fix memory corruption

---
 sys/src/cmd/jpg/readjpg.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/src/cmd/jpg/readjpg.c b/sys/src/cmd/jpg/readjpg.c
index 8653d72d2..ddc3227f6 100644
--- a/sys/src/cmd/jpg/readjpg.c
+++ b/sys/src/cmd/jpg/readjpg.c
@@ -488,8 +488,10 @@ huffmantable(Header *h, uchar *b)
 
 	/* flow chart C-2 */
 	nsize = 0;
-	for(i=0; i<16; i++)
-		nsize += b[1+i];
+	for(i=1; i<=16; i++)
+		nsize += b[i];
+	if(nsize == 0)
+		return 0;
 	t->size = jpgmalloc(h, (nsize+1)*sizeof(int), 1);
 	k = 0;
 	for(i=1; i<=16; i++){