Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added protection against corrupted GIFs in ReadGIF

Browse Source 
git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@36598 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
This commit is contained in:
David Surovell
2005-12-30 18:38:23 +00:00
parent 203b65dd29
commit 525b0568c9
1 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/common/gifdecod.cpp
View File

@@ -675,6 +675,12 @@ int wxGIFDecoder::ReadGIF()
m_screenw = buf[0] + 256 * buf[1]; m_screenw = buf[0] + 256 * buf[1];
m_screenh = buf[2] + 256 * buf[3]; m_screenh = buf[2] + 256 * buf[3];
const int maxScreenSize = 4 << 10;
if ((m_screenw <= 0) || (m_screenw > maxScreenSize) || (m_screenh <= 0) || (m_screenh > maxScreenSize))
{
return wxGIF_INVFORMAT;
}
/* load global color map if available */ /* load global color map if available */
if ((buf[4] & 0x80) == 0x80) if ((buf[4] & 0x80) == 0x80)
{ {
@@ -843,6 +849,11 @@ int wxGIFDecoder::ReadGIF()
/* get initial code size from first byte in raster data */ /* get initial code size from first byte in raster data */
bits = (unsigned char)m_f->GetC(); bits = (unsigned char)m_f->GetC();
if (bits == 0)
{
Destroy();
return wxGIF_INVFORMAT;
}
/* decode image */ /* decode image */
int result = dgif(pimg, interl, bits); int result = dgif(pimg, interl, bits);
@@ -859,7 +870,7 @@ int wxGIFDecoder::ReadGIF()
} }
} }
if (m_nimages == 0) if (m_nimages <= 0)
{ {
Destroy(); Destroy();
return wxGIF_INVFORMAT; return wxGIF_INVFORMAT;
@@ -904,6 +915,12 @@ int wxGIFDecoder::ReadGIF()
if ((buf[8] & 0x80) == 0x80) if ((buf[8] & 0x80) == 0x80)
{ {
ncolors = 2 << (buf[8] & 0x07); ncolors = 2 << (buf[8] & 0x07);
if (ncolors <= 0)
{
Destroy();
return wxGIF_INVFORMAT;
}
wxFileOffset pos = m_f->TellI(); wxFileOffset pos = m_f->TellI();
wxFileOffset numBytes = 3 * ncolors; wxFileOffset numBytes = 3 * ncolors;
m_f->SeekI(numBytes, wxFromCurrent); m_f->SeekI(numBytes, wxFromCurrent);