summaryrefslogtreecommitdiff
path: root/Build/source/libs/gd/libgd-src/src/gd_gif_in.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/gd/libgd-src/src/gd_gif_in.c')
-rw-r--r--Build/source/libs/gd/libgd-src/src/gd_gif_in.c24
1 files changed, 16 insertions, 8 deletions
diff --git a/Build/source/libs/gd/libgd-src/src/gd_gif_in.c b/Build/source/libs/gd/libgd-src/src/gd_gif_in.c
index c1954480143..1ae0e32b23f 100644
--- a/Build/source/libs/gd/libgd-src/src/gd_gif_in.c
+++ b/Build/source/libs/gd/libgd-src/src/gd_gif_in.c
@@ -53,7 +53,7 @@ static int set_verbose(void)
#define BitSet(byte, bit) (((byte) & (bit)) == (bit))
-#define ReadOK(file, buffer, len) (gdGetBuf(buffer, len, file) > 0)
+#define ReadOK(file, buffer, len) (gdGetBuf(buffer, len, file) == len)
#define LM_to_uint(a, b) (((b)<<8)|(a))
@@ -149,7 +149,7 @@ static void ReadImage (gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned
> in = fopen("mygif.gif", "rb");
> im = gdImageCreateFromGif(in);
> fclose(in);
- > // ... Use the image ...
+ > // ... Use the image ...
> gdImageDestroy(im);
*/
@@ -335,11 +335,6 @@ terminated:
return 0;
}
- if(!im->colorsTotal) {
- gdImageDestroy(im);
- return 0;
- }
-
/* Check for open colors at the end, so
* we can reduce colorsTotal and ultimately
* BitsPerPixel */
@@ -351,6 +346,11 @@ terminated:
}
}
+ if(!im->colorsTotal) {
+ gdImageDestroy(im);
+ return 0;
+ }
+
return im;
}
@@ -447,7 +447,7 @@ static int
GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
{
int i, j, ret;
- unsigned char count;
+ int count;
if(flag) {
scd->curbit = 0;
@@ -601,6 +601,10 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
/* Bad compressed data stream */
return -1;
}
+ if(code >= (1 << MAX_LWZ_BITS)) {
+ /* Corrupted code */
+ return -1;
+ }
*sd->sp++ = sd->table[1][code];
@@ -610,6 +614,10 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
code = sd->table[0][code];
}
+ if(code >= (1 << MAX_LWZ_BITS)) {
+ /* Corrupted code */
+ return -1;
+ }
*sd->sp++ = sd->firstcode = sd->table[1][code];