X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/525b0568c9882692cf31bf4d5a308940154cb350..6415637cb0da1aa1eb0b6a73b9f1757e80f53a9a:/src/common/gifdecod.cpp?ds=sidebyside diff --git a/src/common/gifdecod.cpp b/src/common/gifdecod.cpp index 8213e583ef..db8ac994df 100644 --- a/src/common/gifdecod.cpp +++ b/src/common/gifdecod.cpp @@ -675,8 +675,7 @@ int wxGIFDecoder::ReadGIF() m_screenw = buf[0] + 256 * buf[1]; m_screenh = buf[2] + 256 * buf[3]; - const int maxScreenSize = 4 << 10; - if ((m_screenw <= 0) || (m_screenw > maxScreenSize) || (m_screenh <= 0) || (m_screenh > maxScreenSize)) + if ((m_screenw == 0) || (m_screenh == 0)) { return wxGIF_INVFORMAT; } @@ -803,7 +802,7 @@ int wxGIFDecoder::ReadGIF() pimg->w = buf[4] + 256 * buf[5]; pimg->h = buf[6] + 256 * buf[7]; - if (pimg->w == 0 || pimg->h == 0) + if ((pimg->w == 0) || (pimg->w > m_screenw) || (pimg->h == 0) || (pimg->h > m_screenh)) { Destroy(); return wxGIF_INVFORMAT; @@ -915,12 +914,6 @@ int wxGIFDecoder::ReadGIF() if ((buf[8] & 0x80) == 0x80) { ncolors = 2 << (buf[8] & 0x07); - if (ncolors <= 0) - { - Destroy(); - return wxGIF_INVFORMAT; - } - wxFileOffset pos = m_f->TellI(); wxFileOffset numBytes = 3 * ncolors; m_f->SeekI(numBytes, wxFromCurrent);