Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 373794: grash with malformed gif, r=tor, sr=pavlov, a=dveditz

Browse Source 
git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_0_BRANCH@224163 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
crowder%fiverocks.com
2007-04-04 19:21:06 +00:00
parent d475945af8
commit b484074267
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
mozilla/modules/libpr0n/decoders/gif/GIF2.cpp
View File

@@ -347,7 +347,7 @@ static int do_lzw(gif_struct *gs, const PRUint8 *q)
*stackp++ = suffix[code];
code = prefix[code];
if (stackp == stack + MAX_BITS)
if (stackp == stack + MAX_BITS || code >= MAX_BITS)
return -1;
}
@@ -468,7 +468,7 @@ PRStatus gif_write(gif_struct *gs, const PRUint8 *buf, PRUint32 len)
{
/* Initialize LZW parser/decoder */
gs->datasize = *q;
if (gs->datasize > MAX_LZW_BITS) {
if (gs->datasize >= MAX_LZW_BITS) {
gs->state = gif_error;
break;
}