diff options
Diffstat (limited to 'gdk-pixbuf')
| -rw-r--r-- | gdk-pixbuf/ChangeLog | 4 | ||||
| -rw-r--r-- | gdk-pixbuf/io-gif.c | 11 |
2 files changed, 15 insertions, 0 deletions
diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog index 494890123..ebf30d087 100644 --- a/gdk-pixbuf/ChangeLog +++ b/gdk-pixbuf/ChangeLog @@ -1,3 +1,7 @@ +2002-03-15 Matthias Clasen <maclas@gmx.de> + + * io-gif.c (gif_get_frame_info): Catch invalid frame dimensions. + 2002-03-13 Matthias Clasen <maclas@gmx.de> * test-images.h: Add valid_ras_test and invalid_bmp_1. diff --git a/gdk-pixbuf/io-gif.c b/gdk-pixbuf/io-gif.c index c01a58ff0..a5cab7a46 100644 --- a/gdk-pixbuf/io-gif.c +++ b/gdk-pixbuf/io-gif.c @@ -1135,6 +1135,17 @@ gif_get_frame_info (GifContext *context) context->x_offset = LM_to_uint (buf[0], buf[1]); context->y_offset = LM_to_uint (buf[2], buf[3]); + if ((context->frame_height == 0) || (context->frame_len == 0)) { + context->state = GIF_DONE; + + g_set_error (context->error, + GDK_PIXBUF_ERROR, + GDK_PIXBUF_ERROR_CORRUPT_IMAGE, + _("GIF image contained a frame with height or width 0.")); + + return -2; + } + if (((context->frame_height + context->y_offset) > context->height) || ((context->frame_len + context->x_offset) > context->width)) { /* All frames must fit in the image bounds */ |