diff options
| author | Robert Ancell <robert.ancell@canonical.com> | 2021-06-03 11:05:56 +1200 |
|---|---|---|
| committer | Robert Ancell <robert.ancell@canonical.com> | 2021-06-03 13:42:47 +1200 |
| commit | 6976bdc8ee9dd2c2954f91066f7b0f643769a379 (patch) | |
| tree | dc40e5228d4609b37daed867d5d296ffa46f5907 /gdk-pixbuf | |
| parent | b41548f1ce38a9dbc02703bf251a53f961107ef8 (diff) | |
| download | gdk-pixbuf-6976bdc8ee9dd2c2954f91066f7b0f643769a379.tar.gz | |
gif: Check for overflow when compositing or clearing frames.
Fixes: #190
Similar to fix in 086e8adf4cc352cd11572f96066b001b545f354e
Diffstat (limited to 'gdk-pixbuf')
| -rw-r--r-- | gdk-pixbuf/io-gif-animation.c | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/gdk-pixbuf/io-gif-animation.c b/gdk-pixbuf/io-gif-animation.c index 8335cdd76..71d9265e6 100644 --- a/gdk-pixbuf/io-gif-animation.c +++ b/gdk-pixbuf/io-gif-animation.c @@ -369,7 +369,7 @@ composite_frame (GdkPixbufGifAnim *anim, GdkPixbufFrame *frame) for (i = 0; i < n_indexes; i++) { guint8 index = index_buffer[i]; guint x, y; - int offset; + gsize offset; if (index == frame->transparent_index) continue; @@ -379,11 +379,13 @@ composite_frame (GdkPixbufGifAnim *anim, GdkPixbufFrame *frame) if (x >= anim->width || y >= anim->height) continue; - offset = y * gdk_pixbuf_get_rowstride (anim->last_frame_data) + x * 4; - pixels[offset + 0] = frame->color_map[index * 3 + 0]; - pixels[offset + 1] = frame->color_map[index * 3 + 1]; - pixels[offset + 2] = frame->color_map[index * 3 + 2]; - pixels[offset + 3] = 255; + if (g_size_checked_mul (&offset, gdk_pixbuf_get_rowstride (anim->last_frame_data), y) && + g_size_checked_add (&offset, offset, x * 4)) { + pixels[offset + 0] = frame->color_map[index * 3 + 0]; + pixels[offset + 1] = frame->color_map[index * 3 + 1]; + pixels[offset + 2] = frame->color_map[index * 3 + 2]; + pixels[offset + 3] = 255; + } } out: @@ -448,8 +450,11 @@ gdk_pixbuf_gif_anim_iter_get_pixbuf (GdkPixbufAnimationIter *anim_iter) x_end = MIN (anim->last_frame->x_offset + anim->last_frame->width, anim->width); y_end = MIN (anim->last_frame->y_offset + anim->last_frame->height, anim->height); for (y = anim->last_frame->y_offset; y < y_end; y++) { - guchar *line = pixels + y * gdk_pixbuf_get_rowstride (anim->last_frame_data) + anim->last_frame->x_offset * 4; - memset (line, 0, (x_end - anim->last_frame->x_offset) * 4); + gsize offset; + if (g_size_checked_mul (&offset, gdk_pixbuf_get_rowstride (anim->last_frame_data), y) && + g_size_checked_add (&offset, offset, anim->last_frame->x_offset * 4)) { + memset (pixels + offset, 0, (x_end - anim->last_frame->x_offset) * 4); + } } break; case GDK_PIXBUF_FRAME_REVERT: |