From b48407426796b24c14f2c4b470fcc6e60d4b4bf7 Mon Sep 17 00:00:00 2001 From: "crowder%fiverocks.com" Date: Wed, 4 Apr 2007 19:21:06 +0000 Subject: [PATCH] Bug 373794: grash with malformed gif, r=tor, sr=pavlov, a=dveditz git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_0_BRANCH@224163 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/modules/libpr0n/decoders/gif/GIF2.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp b/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp index 0623b3c89fd..6032930e60f 100644 --- a/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp +++ b/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp @@ -347,7 +347,7 @@ static int do_lzw(gif_struct *gs, const PRUint8 *q) *stackp++ = suffix[code]; code = prefix[code]; - if (stackp == stack + MAX_BITS) + if (stackp == stack + MAX_BITS || code >= MAX_BITS) return -1; } @@ -468,7 +468,7 @@ PRStatus gif_write(gif_struct *gs, const PRUint8 *buf, PRUint32 len) { /* Initialize LZW parser/decoder */ gs->datasize = *q; - if (gs->datasize > MAX_LZW_BITS) { + if (gs->datasize >= MAX_LZW_BITS) { gs->state = gif_error; break; }