Fix off-by-one bounds check in jpegli_add_quant_table

[Mohdhsn-00]

Summary

jpegli_add_quant_table guarded its table index with which_tbl > NUM_QUANT_TBLS
instead of >= NUM_QUANT_TBLS. Since quant_tbl_ptrs is a fixed 4-element array
(JQUANT_TBL* quant_tbl_ptrs[NUM_QUANT_TBLS], NUM_QUANT_TBLS == 4), the check
accepted which_tbl == 4 — one past the end of the array.

Impact

which_tbl is a caller-supplied argument of a public, libjpeg-compatible API.
With which_tbl == 4:

• cinfo->quant_tbl_ptrs[4] is read out of bounds (into the adjacent struct field).
• If that reads as null, a freshly allocated pointer is written out of bounds into
  quant_tbl_ptrs[4].
• If it reads as non-null, it is dereferenced and 64 quantval entries + sent_table
  are written through it.

This is an out-of-bounds read/write (CWE-193 → CWE-787/CWE-125) reachable through the
public API.

Fix

Change > to >=, rejecting the invalid index 4 with the existing JPEGLI_ERROR
path.

-  if (which_tbl < 0 || which_tbl > NUM_QUANT_TBLS) {
+  if (which_tbl < 0 || which_tbl >= NUM_QUANT_TBLS) {
     JPEGLI_ERROR("Invalid quant table index %d", which_tbl);
   }

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.