[gdk-pixbuf] gif: Initialise code_last_byte to not cause undefined behaviour
- From: Bastien Nocera <hadess src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [gdk-pixbuf] gif: Initialise code_last_byte to not cause undefined behaviour
- Date: Mon, 4 Dec 2017 16:32:10 +0000 (UTC)
commit c1fd9f5d6592c0183c54efc806b3ca6871e1f496
Author: Tobias Mueller <muelli cryptobitch de>
Date: Fri Nov 10 18:51:21 2017 +0100
gif: Initialise code_last_byte to not cause undefined behaviour
Currently, code_last_byte is set only after it has been used, i.e.
context->block_buf[0] = context->block_buf[context->code_last_byte - 2];
comes before anything has touched context->code_last_byte yet.
Except for the initialisation.
context->code_last_byte is set a few lines later, though.
And nowhere else, except for the initialisation which sets it
to 0. That will inevitably lead to context->block_buf[-2] which is
undefined behaviour.
We hence set the code_last_byte to 2 in order to not make that
array index invalid.
https://bugzilla.gnome.org/show_bug.cgi?id=778584
gdk-pixbuf/io-gif.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)
---
diff --git a/gdk-pixbuf/io-gif.c b/gdk-pixbuf/io-gif.c
index acbd1f3..61821bd 100644
--- a/gdk-pixbuf/io-gif.c
+++ b/gdk-pixbuf/io-gif.c
@@ -1165,7 +1165,12 @@ gif_prepare_lzw (GifContext *context)
context->lzw_fresh = TRUE;
context->code_curbit = 0;
context->code_lastbit = 0;
- context->code_last_byte = 0;
+ /* During initialistion (in gif_lzw_fill_buffer) we substract 2 from
+ * this value to peek into a buffer.
+ * In order to not get a negative array index later, we set the value
+ * to that magic 2 now.
+ */
+ context->code_last_byte = 2;
context->code_done = FALSE;
g_assert (context->lzw_clear_code <=
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]