Lerking/gtk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for stack overflow throughout. (#91808, Elliot Lee)

Browse Source 
* io-gif.c (lzw_read_byte): Check for stack overflow throughout.
	(#91808, Elliot Lee)
This commit is contained in:
Matthias Clasen
2002-10-22 22:45:35 +00:00
parent 35211e0e34
commit 4b25e80f50
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
gdk-pixbuf/ChangeLog
View File

@@ -1,3 +1,8 @@
2002-10-23 Matthias Clasen <maclas@gmx.de>
* io-gif.c (lzw_read_byte): Check for stack overflow throughout.
(#91808, Elliot Lee)
Thu Oct 3 18:25:57 2002 Owen Taylor <otaylor@redhat.com>
* io-jpeg.c (gdk_pixbuf__jpeg_image_save):

14
gdk-pixbuf/io-gif.c
View File

@@ -534,6 +534,14 @@ gif_lzw_clear_code (GifContext *context)
return 0;
}
#define CHECK_LZW_SP() if(((guchar *)context->lzw_sp) >= (((guchar *)context->lzw_stack) + sizeof(context->lzw_stack))) { \
g_set_error (context->error, \
GDK_PIXBUF_ERROR, \
GDK_PIXBUF_ERROR_CORRUPT_IMAGE, \
_("Stack overflow")); \
return -2; \
}
static int
lzw_read_byte (GifContext *context)
{
@@ -608,19 +616,20 @@ lzw_read_byte (GifContext *context)
incode = code;
if (code >= context->lzw_max_code) {
CHECK_LZWP_SP ();
*(context->lzw_sp)++ = context->lzw_firstcode;
code = context->lzw_oldcode;
}
while (code >= context->lzw_clear_code) {
if ((code >= (1 << MAX_LZW_BITS))
|| (context->lzw_sp >= context->lzw_stack + ((1 << (MAX_LZW_BITS)) * 2 + 1))) {
if (code >= (1 << MAX_LZW_BITS)) {
g_set_error (context->error,
GDK_PIXBUF_ERROR,
GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
_("Bad code encountered"));
return -2;
}
CHECK_LZWP_SP ();
*(context->lzw_sp)++ = context->lzw_table[1][code];
if (code == context->lzw_table[0][code]) {
@@ -633,6 +642,7 @@ lzw_read_byte (GifContext *context)
code = context->lzw_table[0][code];
}
CHECK_LZWP_SP ();
*(context->lzw_sp)++ = context->lzw_firstcode = context->lzw_table[1][code];
if ((code = context->lzw_max_code) < (1 << MAX_LZW_BITS)) {