From 3180db0c6dcdc87b736ec64e84aaa2e16dbbd074 Mon Sep 17 00:00:00 2001
From: Julian Smart <julian@anthemion.co.uk>
Date: Sun, 27 Sep 2009 11:09:52 +0000
Subject: [PATCH] Applied #9465 (Error reading GIF with incorrect animation
 size) By Marc Oldenhof

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/branches/WX_2_8_BRANCH@62165 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---
 src/common/gifdecod.cpp | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/src/common/gifdecod.cpp b/src/common/gifdecod.cpp
index 30c214aad6..478ddb93e1 100644
--- a/src/common/gifdecod.cpp
+++ b/src/common/gifdecod.cpp
@@ -755,12 +755,38 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
             pimg->w = buf[4] + 256 * buf[5];
             pimg->h = buf[6] + 256 * buf[7];
 
+#if 0
             if (anim && ((pimg->w == 0) || (pimg->w > (unsigned int)m_szAnimation.GetWidth()) ||
                 (pimg->h == 0) || (pimg->h > (unsigned int)m_szAnimation.GetHeight())))
             {
                 Destroy();
                 return wxGIF_INVFORMAT;
             }
+#endif
+            if ( anim )
+            {
+                // some GIF images specify incorrect animation size but we can
+                // still open them if we fix up the animation size, see #9465
+                if ( m_nFrames == 0 )
+                {
+                    if ( pimg->w > (unsigned)m_szAnimation.x )
+                        m_szAnimation.x = pimg->w;
+                    if ( pimg->h > (unsigned)m_szAnimation.y )
+                        m_szAnimation.y = pimg->h;
+                }
+                else // subsequent frames
+                {
+                    // check that we have valid size
+                    if ( (!pimg->w || pimg->w > (unsigned)m_szAnimation.x) ||
+                            (!pimg->h || pimg->h > (unsigned)m_szAnimation.y) )
+                    {
+                        wxLogError(_("Incorrect GIF frame size (%u, %d) for the frame #%u"),
+                                   pimg->w, pimg->h, m_nFrames);
+                        Destroy();
+                        return wxGIF_INVFORMAT;
+                    }
+                }
+            }
 
             interl = ((buf[8] & 0x40)? 1 : 0);
             size = pimg->w * pimg->h;