two more ReadGIF tweaks

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@36601 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/src/common/gifdecod.cpp b/src/common/gifdecod.cpp
index 8213e583ef1dbeccd8285b2b322004d547ff49d5..68be026a7bb76f0025323b2ce6df31fdd70589d9 100644 (file)
--- a/src/common/gifdecod.cpp
+++ b/src/common/gifdecod.cpp
@@ -803,7 +803,7 @@ int wxGIFDecoder::ReadGIF()
             pimg->w = buf[4] + 256 * buf[5];
             pimg->h = buf[6] + 256 * buf[7];
 
             pimg->w = buf[4] + 256 * buf[5];
             pimg->h = buf[6] + 256 * buf[7];
 

-            if (pimg->w == 0 || pimg->h == 0)
+            if ((pimg->w <= 0) || (pimg->w > maxScreenSize) || (pimg->h <= 0) || (pimg->h > maxScreenSize))

             {
                 Destroy();
                 return wxGIF_INVFORMAT;
             {
                 Destroy();
                 return wxGIF_INVFORMAT;


@@ -835,8 +835,9 @@ int wxGIFDecoder::ReadGIF()
             {
                 ncolors = 2 << (buf[8] & 0x07);
                 size_t numBytes = 3 * ncolors;
             {
                 ncolors = 2 << (buf[8] & 0x07);
                 size_t numBytes = 3 * ncolors;

-                m_f->Read(pimg->pal, numBytes);
-                if (m_f->LastRead() != numBytes)
+                if (numBytes > 0)
+                    m_f->Read(pimg->pal, numBytes);
+                if ((numBytes <= 0) || (m_f->LastRead() != numBytes))

                 {
                     Destroy();
                     return wxGIF_INVFORMAT;
                 {
                     Destroy();
                     return wxGIF_INVFORMAT;