diff options
Diffstat (limited to 'Build/source/libs/gd/libgd-src/src/gd_gif_in.c')
-rw-r--r-- | Build/source/libs/gd/libgd-src/src/gd_gif_in.c | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/Build/source/libs/gd/libgd-src/src/gd_gif_in.c b/Build/source/libs/gd/libgd-src/src/gd_gif_in.c index c1954480143..1ae0e32b23f 100644 --- a/Build/source/libs/gd/libgd-src/src/gd_gif_in.c +++ b/Build/source/libs/gd/libgd-src/src/gd_gif_in.c @@ -53,7 +53,7 @@ static int set_verbose(void) #define BitSet(byte, bit) (((byte) & (bit)) == (bit)) -#define ReadOK(file, buffer, len) (gdGetBuf(buffer, len, file) > 0) +#define ReadOK(file, buffer, len) (gdGetBuf(buffer, len, file) == len) #define LM_to_uint(a, b) (((b)<<8)|(a)) @@ -149,7 +149,7 @@ static void ReadImage (gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned > in = fopen("mygif.gif", "rb"); > im = gdImageCreateFromGif(in); > fclose(in); - > // ... Use the image ... + > // ... Use the image ... > gdImageDestroy(im); */ @@ -335,11 +335,6 @@ terminated: return 0; } - if(!im->colorsTotal) { - gdImageDestroy(im); - return 0; - } - /* Check for open colors at the end, so * we can reduce colorsTotal and ultimately * BitsPerPixel */ @@ -351,6 +346,11 @@ terminated: } } + if(!im->colorsTotal) { + gdImageDestroy(im); + return 0; + } + return im; } @@ -447,7 +447,7 @@ static int GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP) { int i, j, ret; - unsigned char count; + int count; if(flag) { scd->curbit = 0; @@ -601,6 +601,10 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i /* Bad compressed data stream */ return -1; } + if(code >= (1 << MAX_LWZ_BITS)) { + /* Corrupted code */ + return -1; + } *sd->sp++ = sd->table[1][code]; @@ -610,6 +614,10 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i code = sd->table[0][code]; } + if(code >= (1 << MAX_LWZ_BITS)) { + /* Corrupted code */ + return -1; + } *sd->sp++ = sd->firstcode = sd->table[1][code]; |