From 8013100ab87df53cd090742b44608d9b85d0dbf8 Mon Sep 17 00:00:00 2001
From: fkaelberer <o_0_o@gmx.de>
Date: Fri, 23 Jan 2015 09:13:50 +0100
Subject: [PATCH] avoid out of range array access in JBIG2 decoder

---
 src/core/jbig2.js | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/core/jbig2.js b/src/core/jbig2.js
index 0d846b52c..ad3149c3f 100755
--- a/src/core/jbig2.js
+++ b/src/core/jbig2.js
@@ -179,10 +179,9 @@ var Jbig2Image = (function Jbig2ImageClosure() {
 
         // At each pixel: Clear contextLabel pixels that are shifted
         // out of the context, then add new ones.
-        // If j + n is out of range at the right image border, then
-        // the undefined value of bitmap[i - 2][j + n] is shifted to 0
         contextLabel = ((contextLabel & OLD_PIXEL_MASK) << 1) |
-                       (row2[j + 3] << 11) | (row1[j + 4] << 4) | pixel;
+                       (j + 3 < width ? row2[j + 3] << 11 : 0) |
+                       (j + 4 < width ? row1[j + 4] << 4 : 0) | pixel;
       }
     }