suzanne.soy/racket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avoid crashing on buggy GIF

Browse Source 
svn: r864
This commit is contained in:
Matthew Flatt 2005-09-16 12:34:26 +00:00
parent e5b7f9123d
commit 04dd9be199
1 changed files with 26 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
src/wxmac/src/mac/wximgfil.cc
View File

@ -288,14 +288,14 @@ ushort wxGIF::get_next_code()
*/ */
pbytes = 0; pbytes = 0;
navail_bytes = get_byte(); navail_bytes = get_byte();
if (navail_bytes) if (navail_bytes) {
{ for (i = 0; i < navail_bytes; ++i)
for (i = 0; i < navail_bytes; ++i) {
{ x = get_byte();
x = get_byte(); byte_buff[i] = x;
byte_buff[i] = x; }
} } else
} navail_bytes = 1; /* to avoid underflow */
} }
b1 = byte_buff[pbytes++]; b1 = byte_buff[pbytes++];
nbits_left = 8; nbits_left = 8;
@ -312,14 +312,14 @@ ushort wxGIF::get_next_code()
*/ */
pbytes = 0; pbytes = 0;
navail_bytes = get_byte(); navail_bytes = get_byte();
if (navail_bytes) if (navail_bytes) {
{ for (i = 0; i < navail_bytes; ++i)
for (i = 0; i < navail_bytes; ++i) {
{ x = get_byte();
x = get_byte(); byte_buff[i] = x;
byte_buff[i] = x; }
} } else
} navail_bytes = 1; /* to avoid underflow */
} }
b1 = byte_buff[pbytes++]; b1 = byte_buff[pbytes++];
ret |= b1 << nbits_left; ret |= b1 << nbits_left;
@ -477,6 +477,8 @@ ushort wxGIF::decoder(ushort linewidth)
if (code > slot) if (code > slot)
++bad_code_count; ++bad_code_count;
code = oc; code = oc;
if (sp > MAX_CODES)
return BAD_CODE_SIZE;
stack[sp++] = fc; stack[sp++] = fc;
} }
@ -485,8 +487,14 @@ ushort wxGIF::decoder(ushort linewidth)
*/ */
while (code >= newcodes) while (code >= newcodes)
{ {
if (sp > MAX_CODES)
return BAD_CODE_SIZE;
stack[sp++] = suffix[code]; stack[sp++] = suffix[code];
code = prefix[code]; code = prefix[code];
if (code >= slot) {
++bad_code_count;
code = oc;
}
} }
/* Push the last character on the stack, and set up the new /* Push the last character on the stack, and set up the new
@ -496,6 +504,8 @@ ushort wxGIF::decoder(ushort linewidth)
* suffix and prefix... I'm not certain if this is correct... * suffix and prefix... I'm not certain if this is correct...
* it might be more proper to overwrite the last code... * it might be more proper to overwrite the last code...
*/ */
if (sp > MAX_CODES)
return BAD_CODE_SIZE;
stack[sp++] = code; stack[sp++] = code;
if (slot < top_slot) if (slot < top_slot)
{ {