- #38112, corrupt GIF segfaults, test will follow

1 files changed, 20 insertions, 6 deletions

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 78c454589e..b4bc7752d0 100644
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -206,6 +206,7 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
 					BitSet(buf[8], INTERLACE));
 			/*1.4//imageCount != imageNumber); */
 		}
+
 		if (Transparent != (-1)) {
 			gdImageColorTransparent(im, Transparent);
 		}
@@ -217,6 +218,12 @@ terminated:
 	if (!im) {
 		return 0;
 	}
+
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
+
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -506,6 +513,19 @@ static void ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned
 	int             v;
 	int             xpos = 0, ypos = 0, pass = 0;
 	int i;
+
+
+	/*
+	 **  Initialize the Compression routines
+	 */
+	if (! ReadOK(fd,&c,1)) {
+		return;
+	}
+
+	if (c > 8) {
+		return;	
+	}
+
 	/* Stash the color map into the image */
 	for (i=0; (i<gdMaxColors); i++) {
 		im->red[i] = cmap[CM_RED][i];
@@ -515,12 +535,6 @@ static void ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned
 	}
 	/* Many (perhaps most) of these colors will remain marked open. */
 	im->colorsTotal = gdMaxColors;
-	/*
-	 **  Initialize the Compression routines
-	 */
-	if (! ReadOK(fd,&c,1)) {
-		return;
-	}
 	if (LWZReadByte(fd, TRUE, c) < 0) {
 		return;
 	}