func: static int CVE_2013_4264_VULN_kempf_decode_tile(G2MContext *c, int tile_x, int const uint8_t *src, int src_size) int width , height ; int i , j ; const uint8_t * src_end = src + src_size ; uint8_t pal [ 768 ] , transp [ 3 ] ; int sub_type ; int nblocks , cblocks , bstride ; int bits , bitbuf , coded ; if ( src_size < 2 )  width = FFMIN ( c -> width - tile_x * c -> tile_width , c -> tile_width ); height = FFMIN ( c -> height - tile_y * c -> tile_height , c -> tile_height ); hdr = * src ++; sub_type = hdr >> 5; if ( sub_type == 0 )  int j ; if ( sub_type == 1 )  if ( sub_type != 2 )  memcpy ( transp , src , 3 ); src += 3; npal = * src ++ + 1; memcpy ( pal , src , npal * 3 ); src += npal * 3; if ( sub_type != 2 )  for (i = 0; i < npal; i++) if ( ! memcmp ( pal + i * 3 , transp , 3 ) )  if ( src_end - src < 2 )  zsize = ( src [ 0 ] << 8 ) | src [ 1 ]; src += 2; if ( src_end - src < zsize )  ret = uncompress ( c -> kempf_buf , & dlen , src , zsize ); if ( ret )  src += zsize; if ( sub_type == 2 )  nblocks = * src ++ + 1; cblocks = 0; bstride = FFALIGN ( width , 16 ) >> 4; bits = 0; for (i = 0; i < (FFALIGN(height, 16) >> 4); i++) for (j = 0; j < (FFALIGN(width, 16) >> 4); j++) if ( ! bits )  bitbuf = * src ++; bits = 8; coded = bitbuf & 1; bits --; bitbuf >>= 1; cblocks += coded; if ( cblocks > nblocks )  c -> kempf_flags [ j + i * bstride ] = coded; memset ( c -> jpeg_tile , 0 , c -> tile_stride * height ); jpg_decode_data ( & c -> jc , width , height , src , src_end - src , c -> jpeg_tile , c -> tile_stride , c -> kempf_flags , bstride , nblocks , 0 ); kempf_restore_buf ( c -> kempf_buf , dlen , dst , c -> framebuf_stride , c -> jpeg_tile , c -> tile_stride , width , height , pal , npal , tidx ); 