Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

relaxed ReadGIF error checking as per review

Browse Source 
git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@36618 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
This commit is contained in:
David Surovell
2006-01-01 20:19:13 +00:00
parent 80b1853f9e
commit 295dec28c3
1 changed files with 4 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/common/gifdecod.cpp
View File

@@ -675,8 +675,7 @@ int wxGIFDecoder::ReadGIF()
m_screenw = buf[0] + 256 * buf[1]; m_screenw = buf[0] + 256 * buf[1];
m_screenh = buf[2] + 256 * buf[3]; m_screenh = buf[2] + 256 * buf[3];
const int maxScreenSize = 4 << 10; if ((m_screenw == 0) || (m_screenh == 0))
if ((m_screenw <= 0) || (m_screenw > maxScreenSize) || (m_screenh <= 0) || (m_screenh > maxScreenSize))
{ {
return wxGIF_INVFORMAT; return wxGIF_INVFORMAT;
} }
@@ -803,7 +802,7 @@ int wxGIFDecoder::ReadGIF()
pimg->w = buf[4] + 256 * buf[5]; pimg->w = buf[4] + 256 * buf[5];
pimg->h = buf[6] + 256 * buf[7]; pimg->h = buf[6] + 256 * buf[7];
if ((pimg->w <= 0) || (pimg->w > maxScreenSize) || (pimg->h <= 0) || (pimg->h > maxScreenSize)) if ((pimg->w == 0) || (pimg->w > m_screenw) || (pimg->h == 0) || (pimg->h > m_screenh))
{ {
Destroy(); Destroy();
return wxGIF_INVFORMAT; return wxGIF_INVFORMAT;
@@ -835,9 +834,8 @@ int wxGIFDecoder::ReadGIF()
{ {
ncolors = 2 << (buf[8] & 0x07); ncolors = 2 << (buf[8] & 0x07);
size_t numBytes = 3 * ncolors; size_t numBytes = 3 * ncolors;
if (numBytes > 0) m_f->Read(pimg->pal, numBytes);
m_f->Read(pimg->pal, numBytes); if (m_f->LastRead() != numBytes)
if ((numBytes <= 0) || (m_f->LastRead() != numBytes))
{ {
Destroy(); Destroy();
return wxGIF_INVFORMAT; return wxGIF_INVFORMAT;
@@ -916,12 +914,6 @@ int wxGIFDecoder::ReadGIF()
if ((buf[8] & 0x80) == 0x80) if ((buf[8] & 0x80) == 0x80)
{ {
ncolors = 2 << (buf[8] & 0x07); ncolors = 2 << (buf[8] & 0x07);
if (ncolors <= 0)
{
Destroy();
return wxGIF_INVFORMAT;
}
wxFileOffset pos = m_f->TellI(); wxFileOffset pos = m_f->TellI();
wxFileOffset numBytes = 3 * ncolors; wxFileOffset numBytes = 3 * ncolors;
m_f->SeekI(numBytes, wxFromCurrent); m_f->SeekI(numBytes, wxFromCurrent);