[librsvg] bgo#630732 - Fix out-of-bounds read in feComponentTransfer with tableValues

[Federico Mena Quintero <federico src gnome org>]

commit 0b2b1424caeb3fa928689d9ed956edddb0e3e7ec
Author: Federico Mena Quintero <federico gnome org>
Date:   Wed Oct 21 17:21:02 2015 -0500

    bgo#630732 - Fix out-of-bounds read in feComponentTransfer with tableValues
    
    https://bugzilla.gnome.org/show_bug.cgi?id=630732

 rsvg-filter.c |   11 +++++++----
 1 files changed, 7 insertions(+), 4 deletions(-)
---
diff --git a/rsvg-filter.c b/rsvg-filter.c
index 7fb193a..b4eedec 100644
--- a/rsvg-filter.c
+++ b/rsvg-filter.c
@@ -2550,14 +2550,17 @@ table_component_transfer_func (gint C, RsvgNodeComponentTransferFunc * user_data
 {
     guint k;
     gint vk, vk1, distancefromlast;
+    guint num_values;
 
     if (!user_data->nbTableValues)
         return C;
 
-    k = (C * (user_data->nbTableValues - 1)) / 255;
+    num_values = user_data->nbTableValues;
 
-    vk = user_data->tableValues[k];
-    vk1 = user_data->tableValues[k + 1];
+    k = (C * (num_values - 1)) / 255;
+
+    vk = user_data->tableValues[CLAMP (k, 0, num_values - 1)];
+    vk1 = user_data->tableValues[CLAMP (k + 1, 0, num_values - 1)];
 
     distancefromlast = (C * (user_data->nbTableValues - 1)) - k * 255;
 
@@ -2574,7 +2577,7 @@ discrete_component_transfer_func (gint C, RsvgNodeComponentTransferFunc * user_d
 
     k = (C * user_data->nbTableValues) / 255;
 
-    return user_data->tableValues[k];
+    return user_data->tableValues[CLAMP (k, 0, user_data->nbTableValues)];
 }
 
 static gint