Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-03 02:25:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 199701 - protect against illegal colormap indexes. r=paper, sr=blizzard

Browse Source
This commit is contained in:
tor%cs.brown.edu 2003-04-06 11:54:06 +00:00
parent b07e6600bf
commit 018d28d608
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
modules/libpr0n/decoders/gif/GIF2.cpp
View File

@ -301,10 +301,16 @@ static int do_lzw(gif_struct *gs, const PRUint8 *q)
PRUint8 *rowp = gs->rowp;
PRUint8 *rowend = gs->rowend;
PRUintn rows_remaining = gs->rows_remaining;
PRUint8 max_index;
if (rowp == rowend)
return 0;
if (gs->is_local_colormap_defined)
max_index = gs->local_colormap_size - 1;
else
max_index = gs->global_colormap_size - 1;
#define OUTPUT_ROW(gs) \
PR_BEGIN_MACRO \
output_row(gs); \
@ -342,7 +348,11 @@ static int do_lzw(gif_struct *gs, const PRUint8 *q)
return 0;
if (oldcode == -1) {
*rowp++ = suffix[code];
*rowp = suffix[code];
if (*rowp > max_index)
*rowp = 0;
rowp++;
if (rowp == rowend)
OUTPUT_ROW(gs);
@ -396,7 +406,11 @@ static int do_lzw(gif_struct *gs, const PRUint8 *q)
/* Copy the decoded data out to the scanline buffer. */
do {
*rowp++ = *--stackp;
*rowp = *--stackp;
if (*rowp > max_index)
*rowp = 0;
rowp++;
if (rowp == rowend) {
OUTPUT_ROW(gs);
}