jdhuff.c: Silence UBSan signed int overflow err #2

Same as d3a3a73f64041c6a6905faf6f9f9832e735fd880 but in the fast decode
path.  It was necessary to use a different-sized test image in order to
trigger the error in this location.

Refer to #347

diff --git a/jdhuff.c b/jdhuff.c
index 334ba63b5cb88e10012a5e601278c12b278bb24d..a1128178b0a9bf753d30b5095e9bddf10520e0dc 100644 (file)
--- a/jdhuff.c
+++ b/jdhuff.c
@@ -688,7 +688,7 @@ decode_mcu_fast(j_decompress_ptr cinfo, JBLOCKROW *MCU_data)
 
     if (entropy->dc_needed[blkn]) {
       int ci = cinfo->MCU_membership[blkn];
-      s += state.last_dc_val[ci];
+      s = (int)((unsigned int)s + (unsigned int)state.last_dc_val[ci]);
       state.last_dc_val[ci] = s;
       if (block)
         (*block)[0] = (JCOEF)s;