Pull in r830 from upstream.

jdmarker.c

 /*
  * jdmarker.c
  *
  * Copyright (C) 1991-1998, Thomas G. Lane.
  * Copyright (C) 2012, D. R. Commander.
  * This file is part of the Independent JPEG Group's software.
  * For conditions of distribution and use, see the accompanying README file.
  *
  * This file contains routines to decode JPEG datastream markers.
  * Most of the complexity arises from our desire to support input
@@ skipping 305 matching lines @@
 
   TRACEMS1(cinfo, 1, JTRC_SOS, n);
 
   if (length != (n * 2 + 6) || n < 1 || n > MAX_COMPS_IN_SCAN)
     ERREXIT(cinfo, JERR_BAD_LENGTH);
 
   cinfo->comps_in_scan = n;
 
   /* Collect the component-spec parameters */
 
-  for (i = 0; i < cinfo->num_components; i++)
+  for (i = 0; i < MAX_COMPS_IN_SCAN; i++)
     cinfo->cur_comp_info[i] = NULL;
 
   for (i = 0; i < n; i++) {
     INPUT_BYTE(cinfo, cc, return FALSE);
     INPUT_BYTE(cinfo, c, return FALSE);
     
-    for (ci = 0, compptr = cinfo->comp_info; ci < cinfo->num_components;
+    for (ci = 0, compptr = cinfo->comp_info;
+         ci < cinfo->num_components && ci < MAX_COMPS_IN_SCAN;
          ci++, compptr++) {
       if (cc == compptr->component_id && !cinfo->cur_comp_info[ci])
         goto id_found;
     }
 
     ERREXIT1(cinfo, JERR_BAD_COMPONENT_ID, cc);
 
   id_found:
 
     cinfo->cur_comp_info[i] = compptr;
@@ skipping 1149 matching lines @@
 {
   my_marker_ptr marker = (my_marker_ptr) cinfo->marker;
 
   if (marker_code == (int) M_COM)
     marker->process_COM = routine;
   else if (marker_code >= (int) M_APP0 && marker_code <= (int) M_APP15)
     marker->process_APPn[marker_code - (int) M_APP0] = routine;
   else
     ERREXIT1(cinfo, JERR_UNKNOWN_MARKER, marker_code);
 }