X-Git-Url: https://git.saurik.com/wxWidgets.git/blobdiff_plain/fbf1ee1d0952fed396750cddb01e7cc7904f1d75..38a5c64e29ab1d081af309a73c7af94069cf799f:/src/common/gifdecod.cpp

diff --git a/src/common/gifdecod.cpp b/src/common/gifdecod.cpp
index 8fda5f8ae1..4b3e6ddc87 100644
--- a/src/common/gifdecod.cpp
+++ b/src/common/gifdecod.cpp
@@ -1,5 +1,5 @@
 /////////////////////////////////////////////////////////////////////////////
-// Name:        gifdecod.cpp
+// Name:        src/common/gifdecod.cpp
 // Purpose:     wxGIFDecoder, GIF reader for wxImage and wxAnimation
 // Author:      Guillermo Rodriguez Garcia <guille@iies.es>
 // Version:     3.04
@@ -12,16 +12,15 @@
 #include "wx/wxprec.h"
 
 #ifdef __BORLANDC__
-#  pragma hdrstop
+    #pragma hdrstop
 #endif
 
+#if wxUSE_STREAMS && wxUSE_GIF
+
 #ifndef WX_PRECOMP
-#  include "wx/defs.h"
-#  include "wx/palette.h"
+    #include "wx/palette.h"
 #endif
 
-#if wxUSE_STREAMS && wxUSE_GIF
-
 #include <stdlib.h>
 #include <string.h>
 #include "wx/gifdecod.h"
@@ -467,6 +466,25 @@ int wxGIFDecoder::dgif(GIFImage *img, int interl, int bits)
         /* make new entry in alphabet (only if NOT just cleared) */
         if (lastcode != -1)
         {
+            // Normally, after the alphabet is full and can't grow any
+            // further (ab_free == 4096), encoder should (must?) emit CLEAR
+            // to reset it. This checks whether we really got it, otherwise
+            // the GIF is damaged.
+            if (ab_free > ab_max)
+            {
+                delete[] ab_prefix;
+                delete[] ab_tail;
+                delete[] stack;
+                return wxGIF_INVFORMAT;
+            }
+
+            // This assert seems unnecessary since the condition above
+            // eliminates the only case in which it went false. But I really
+            // don't like being forced to ask "Who in .text could have
+            // written there?!" And I wouldn't have been forced to ask if
+            // this line had already been here.
+            wxASSERT(ab_free < allocSize);
+
             ab_prefix[ab_free] = lastcode;
             ab_tail[ab_free]   = code;
             ab_free++;