[gimp/gimp-2-8] file-gif-load: Fail early in several other places if GetDataBlocks() fails (Bug #737375)



commit 90f13f4f429586842f95a2c28dd1e836c487022a
Author: Mukund Sivaraman <muks banu com>
Date:   Thu Sep 25 23:49:11 2014 +0530

    file-gif-load: Fail early in several other places if GetDataBlocks() fails (Bug #737375)
    
    (cherry picked from commit 2377c8c2a9afc88d1a5665b0b30210459d17dcd8)

 plug-ins/common/file-gif-load.c |   38 +++++++++++++++++++++++++++++++++++---
 1 files changed, 35 insertions(+), 3 deletions(-)
---
diff --git a/plug-ins/common/file-gif-load.c b/plug-ins/common/file-gif-load.c
index c981ec2..9978f5f 100644
--- a/plug-ins/common/file-gif-load.c
+++ b/plug-ins/common/file-gif-load.c
@@ -491,6 +491,11 @@ load_image (const gchar  *filename,
                                 GifScreen.Height);
         }
 
+      if (image_ID < 0)
+        {
+          break;
+        }
+
       if (comment_parasite != NULL)
         {
           if (! thumbnail)
@@ -655,7 +660,7 @@ GetDataBlock (FILE   *fd,
       return -1;
     }
 
-  ZeroDataBlock = count == 0;
+  ZeroDataBlock = (count == 0);
 
   if ((count != 0) && (! ReadOK (fd, buf, count)))
     {
@@ -697,8 +702,15 @@ GetCode (FILE     *fd,
       buf[0] = buf[last_byte - 2];
       buf[1] = buf[last_byte - 1];
 
-      if ((count = GetDataBlock (fd, &buf[2])) <= 0)
-        done = TRUE;
+      count = GetDataBlock (fd, &buf[2]);
+      if (count < 0)
+        {
+          return -1;
+        }
+      else if (count == 0)
+        {
+          done = TRUE;
+        }
 
       last_byte = 2 + count;
       curbit = (curbit - lastbit) + 16;
@@ -776,6 +788,11 @@ LZWReadByte (FILE *fd,
         }
       while (firstcode == clear_code);
 
+      if (firstcode < 0)
+        {
+          return -1;
+        }
+
       return firstcode & 255;
     }
 
@@ -803,6 +820,11 @@ LZWReadByte (FILE *fd,
           sp            = stack;
           firstcode     = oldcode = GetCode (fd, code_size, FALSE);
 
+          if (firstcode < 0)
+            {
+              return -1;
+            }
+
           return firstcode & 255;
         }
       else if (code == end_code || code > max_code)
@@ -864,6 +886,11 @@ LZWReadByte (FILE *fd,
         return (*--sp) & 255;
     }
 
+  if (code < 0)
+    {
+      return -1;
+    }
+
   return code & 255;
 }
 
@@ -1174,6 +1201,11 @@ ReadImage (FILE        *fd,
         break;
     }
 
+  if (v < 0)
+    {
+      return -1;
+    }
+
  fini:
   if (LZWReadByte (fd, FALSE, c) >= 0)
     g_print ("GIF: too much input data, ignoring extra...\n");


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]