diff options
Diffstat (limited to 'jpeg/rdgif.c')
| -rw-r--r-- | jpeg/rdgif.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/jpeg/rdgif.c b/jpeg/rdgif.c index 0cbf8d13f..5d2339ca2 100644 --- a/jpeg/rdgif.c +++ b/jpeg/rdgif.c @@ -2,7 +2,7 @@ * rdgif.c * * Copyright (C) 1991-1996, Thomas G. Lane. - * Modified 2019 by Guido Vollbeding. + * Modified 2019-2020 by Guido Vollbeding. * This file is part of the Independent JPEG Group's software. * For conditions of distribution and use, see the accompanying README file. * @@ -309,7 +309,7 @@ LZWReadByte (gif_source_ptr sinfo) /* Got normal raw byte or LZW symbol */ incode = code; /* save for a moment */ - + if (code >= sinfo->max_code) { /* special case for not-yet-defined symbol */ /* code == max_code is OK; anything bigger is bad data */ if (code > sinfo->max_code) { @@ -342,7 +342,7 @@ LZWReadByte (gif_source_ptr sinfo) sinfo->limit_code <<= 1; /* keep equal to 2^code_size */ } } - + sinfo->oldcode = incode; /* save last input symbol for future use */ return sinfo->firstcode; /* return first byte of symbol's expansion */ } @@ -442,7 +442,7 @@ start_input_gif (j_compress_ptr cinfo, cjpeg_source_ptr sinfo) DoExtension(source); continue; } - + if (c != ',') { /* Not an image separator? */ WARNMS1(cinfo, JWRN_GIF_CHAR, c); continue; @@ -454,6 +454,8 @@ start_input_gif (j_compress_ptr cinfo, cjpeg_source_ptr sinfo) /* we ignore top/left position info, also sort flag */ width = LM_to_uint(hdrbuf, 4); height = LM_to_uint(hdrbuf, 6); + if (width <= 0 || height <= 0) + ERREXIT(cinfo, JERR_GIF_OUTOFRANGE); source->is_interlaced = (BitSet(hdrbuf[8], INTERLACE) != 0); /* Read local colormap if header indicates it is present */ @@ -542,7 +544,7 @@ get_pixel_rows (j_compress_ptr cinfo, cjpeg_source_ptr sinfo) register JSAMPROW ptr; register JDIMENSION col; register JSAMPARRAY colormap = source->colormap; - + ptr = source->pub.buffer[0]; for (col = cinfo->image_width; col > 0; col--) { c = LZWReadByte(source); |