Out of bounds read of size 257728 in IOUtil::FileWriter::Write()

[geeknik]

Triggered in g6d940eb, compiled with afl-gcc on Debian 8 x64.

./lepton -skipvalidate -unjailed -singlethread test059.lep

lepton v1.0-1.2.1-100-g6d940eb
START ACHIEVED 1494554121 392333
=================================================================
==27410==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000010840 at pc 0x7f9cd6a5bd46 bp 0x7ffe51436390 sp 0x7ffe51436378
READ of size 257728 at 0x631000010840 thread T0
    #0 0x7f9cd6a5bd45 in __interceptor_write (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x29d45)
    #1 0x411d62 in IOUtil::FileWriter::Write(unsigned char const*, unsigned int) src/lepton/../io/ioutil.hh:115
    #2 0x411d62 in bounded_iostream::write_no_buffer(void const*, unsigned long) src/lepton/bitops.cc:394
    #3 0x4122f2 in bounded_iostream::flush() src/lepton/bitops.cc:379
    #4 0x4d3300 in recode_baseline_jpeg(bounded_iostream*, int) src/lepton/recoder.cc:844
    #5 0x449fcd in recode_baseline_jpeg_wrapper() src/lepton/jpgcoder.cc:1281
    #6 0x457a89 in std::function<bool ()>::operator()() const /usr/include/c++/4.9/functional:2439
    #7 0x457a89 in execute(std::function<bool ()> const&) src/lepton/jpgcoder.cc:1865
    #8 0x49769c in process_file(IOUtil::FileReader*, IOUtil::FileWriter*, int, bool) src/lepton/jpgcoder.cc:1705
    #9 0x49966e in app_main(int, char**) src/lepton/jpgcoder.cc:924
    #10 0x7f9cd5c69b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
    #11 0x408efc (/root/lepton/lepton+0x408efc)

0x631000010840 is located 0 bytes to the right of 65600-byte region [0x631000000800,0x631000010840)
allocated by thread T0 here:
    #0 0x7f9cd6a86c9b in __interceptor_posix_memalign (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54c9b)
    #1 0x58030c in custom_malloc src/vp8/util/memory.cc:68
    #2 0x58030c in operator new(unsigned long) src/vp8/util/memory.cc:169

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __interceptor_write

test059.zip