[gdk-pixbuf] gif: Initialise code_last_byte to not cause undefined behaviour



commit c1fd9f5d6592c0183c54efc806b3ca6871e1f496
Author: Tobias Mueller <muelli cryptobitch de>
Date:   Fri Nov 10 18:51:21 2017 +0100

    gif: Initialise code_last_byte to not cause undefined behaviour
    
    Currently, code_last_byte is set only after it has been used, i.e.
    
        context->block_buf[0] = context->block_buf[context->code_last_byte - 2];
    
    comes before anything has touched context->code_last_byte yet.
    Except for the initialisation.
    context->code_last_byte is set a few lines later, though.
    And nowhere else, except for the initialisation which sets it
    to 0.  That will inevitably lead to context->block_buf[-2] which is
    undefined behaviour.
    
    We hence set the code_last_byte to 2 in order to not make that
    array index invalid.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=778584

 gdk-pixbuf/io-gif.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)
---
diff --git a/gdk-pixbuf/io-gif.c b/gdk-pixbuf/io-gif.c
index acbd1f3..61821bd 100644
--- a/gdk-pixbuf/io-gif.c
+++ b/gdk-pixbuf/io-gif.c
@@ -1165,7 +1165,12 @@ gif_prepare_lzw (GifContext *context)
        context->lzw_fresh = TRUE;
        context->code_curbit = 0;
        context->code_lastbit = 0;
-       context->code_last_byte = 0;
+       /* During initialistion (in gif_lzw_fill_buffer) we substract 2 from
+        * this value to peek into a buffer.
+        * In order to not get a negative array index later, we set the value
+        * to that magic 2 now.
+        */
+       context->code_last_byte = 2;
        context->code_done = FALSE;
 
         g_assert (context->lzw_clear_code <= 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]