4 files changed, 8 insertions, 3 deletions
diff --git a/METADATA b/METADATA
index c95cb93..fc05e95 100644
--- a/METADATA
+++ b/METADATA
@@ -5,11 +5,11 @@ third_party {
     type: GIT
     value: "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo"
   }
-  version: "d5148db386ceb4a608058320071cbed890bd6ad2"
+  version: "e9a659a09e9600883e499c06ede04ba514d7f942"
   license_type: NOTICE
   last_upgrade_date {
     year: 2020
-    month: 9
+    month: 12
     day: 9
   }
 }
diff --git a/README.chromium b/README.chromium
index 1aa67cf..469e550 100644
--- a/README.chromium
+++ b/README.chromium
@@ -14,10 +14,11 @@ This consists of the components:
 * An OWNERS file
 * A codereview.settings file
 * Patched header files used by Chromium
-* Cherry-picked two additional patches from upstream master to fix bugs found
+* Cherry-picked three additional patches from upstream master to fix bugs found
   by fuzzers:
   https://github.com/libjpeg-turbo/libjpeg-turbo/commit/ccaba5d7894ecfb5a8f11e48d3f86e1f14d5a469
   https://github.com/libjpeg-turbo/libjpeg-turbo/commit/c7ca521bc85b57d41d3ad4963c13fc0100481084
+  https://github.com/libjpeg-turbo/libjpeg-turbo/commit/110d8d6dcafaed517e8f77a6253169535ee3a20e
 * Deleted unused directories: ci, cmakescripts, doc, java, release, sharedlib,
   simd/loongson, simd/mips, simd/powerpc, and win
 * Deleted unused files: appveyor.yml, CMakeLists.txt, doxygen.config,
diff --git a/jdarith.c b/jdarith.c
index 3c7ac57..7f0d3a7 100644
--- a/jdarith.c
+++ b/jdarith.c
@@ -672,6 +672,8 @@ bad:
       for (coefi = MIN(cinfo->Ss, 1); coefi <= MAX(cinfo->Se, 9); coefi++) {
         if (cinfo->input_scan_number > 1)
           prev_coef_bit_ptr[coefi] = coef_bit_ptr[coefi];
+        else
+          prev_coef_bit_ptr[coefi] = 0;
       }
       for (coefi = cinfo->Ss; coefi <= cinfo->Se; coefi++) {
         int expected = (coef_bit_ptr[coefi] < 0) ? 0 : coef_bit_ptr[coefi];
diff --git a/jdphuff.c b/jdphuff.c
index cac4582..0e981f2 100644
--- a/jdphuff.c
+++ b/jdphuff.c
@@ -130,6 +130,8 @@ start_pass_phuff_decoder(j_decompress_ptr cinfo)
     for (coefi = MIN(cinfo->Ss, 1); coefi <= MAX(cinfo->Se, 9); coefi++) {
       if (cinfo->input_scan_number > 1)
         prev_coef_bit_ptr[coefi] = coef_bit_ptr[coefi];
+      else
+        prev_coef_bit_ptr[coefi] = 0;
     }
     for (coefi = cinfo->Ss; coefi <= cinfo->Se; coefi++) {
       int expected = (coef_bit_ptr[coefi] < 0) ? 0 : coef_bit_ptr[coefi];