X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/3103e8a97e834e9793f0eb149aa82a99fd64ef9a..d4d8988c72e26ea5ef68b87a53691da7c3751a95:/src/common/gifdecod.cpp

diff --git a/src/common/gifdecod.cpp b/src/common/gifdecod.cpp
index ad4395a849..8fda5f8ae1 100644
--- a/src/common/gifdecod.cpp
+++ b/src/common/gifdecod.cpp
@@ -8,10 +8,6 @@
 // Licence:     wxWindows licence
 /////////////////////////////////////////////////////////////////////////////
 
-#if defined(__GNUG__) && !defined(NO_GCC_PRAGMA)
-#pragma implementation "gifdecod.h"
-#endif
-
 // For compilers that support precompilation, includes "wx.h".
 #include "wx/wxprec.h"
 
@@ -146,21 +142,18 @@ bool wxGIFDecoder::ConvertToImage(wxImage *image) const
         image->SetMask(false);
 
 #if wxUSE_PALETTE
-    if (pal)
-    {
-        unsigned char r[256];
-        unsigned char g[256];
-        unsigned char b[256];
+    unsigned char r[256];
+    unsigned char g[256];
+    unsigned char b[256];
 
-        for (i = 0; i < 256; i++)
-        {
-            r[i] = pal[3*i + 0];
-            g[i] = pal[3*i + 1];
-            b[i] = pal[3*i + 2];
-        }
-
-        image->SetPalette(wxPalette(256, r, g, b));
+    for (i = 0; i < 256; i++)
+    {
+        r[i] = pal[3*i + 0];
+        g[i] = pal[3*i + 1];
+        b[i] = pal[3*i + 2];
     }
+
+    image->SetPalette(wxPalette(256, r, g, b));
 #endif // wxUSE_PALETTE
 
     /* copy image data */
@@ -679,6 +672,11 @@ int wxGIFDecoder::ReadGIF()
     m_screenw = buf[0] + 256 * buf[1];
     m_screenh = buf[2] + 256 * buf[3];
 
+    if ((m_screenw == 0) || (m_screenh == 0))
+    {
+        return wxGIF_INVFORMAT;
+    }
+
     /* load global color map if available */
     if ((buf[4] & 0x80) == 0x80)
     {
@@ -705,7 +703,7 @@ int wxGIFDecoder::ReadGIF()
 
     bool done = false;
 
-    while(!done)
+    while (!done)
     {
         type = (unsigned char)m_f->GetC();
 
@@ -801,7 +799,7 @@ int wxGIFDecoder::ReadGIF()
             pimg->w = buf[4] + 256 * buf[5];
             pimg->h = buf[6] + 256 * buf[7];
 
-            if (pimg->w == 0 || pimg->h == 0)
+            if ((pimg->w == 0) || (pimg->w > m_screenw) || (pimg->h == 0) || (pimg->h > m_screenh))
             {
                 Destroy();
                 return wxGIF_INVFORMAT;
@@ -847,6 +845,11 @@ int wxGIFDecoder::ReadGIF()
 
             /* get initial code size from first byte in raster data */
             bits = (unsigned char)m_f->GetC();
+            if (bits == 0)
+            {
+                Destroy();
+                return wxGIF_INVFORMAT;
+            }
 
             /* decode image */
             int result = dgif(pimg, interl, bits);
@@ -863,7 +866,7 @@ int wxGIFDecoder::ReadGIF()
         }
     }
 
-    if (m_nimages == 0)
+    if (m_nimages <= 0)
     {
         Destroy();
         return wxGIF_INVFORMAT;