Fix for handling of invalid gifs, patch 1587754 Noel Byron.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@42824 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/src/common/gifdecod.cpp b/src/common/gifdecod.cpp
index a96e64b18d6e1e1f7e7f181d0118239689486e6d..e520174b4db7db189de08cbd50b2c89a6ef3b0c1 100644 (file)
--- a/src/common/gifdecod.cpp
+++ b/src/common/gifdecod.cpp
@@ -715,12 +715,12 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
             {
                 while ((i = (unsigned char)stream.GetC()) != 0)
                 {
-                    stream.SeekI(i, wxFromCurrent);
-                    if (stream.Eof())
+                    if (stream.Eof() || (stream.LastRead() == 0))
                     {
                         done = true;
                         break;
                     }
+                    stream.SeekI(i, wxFromCurrent);
                 }
             }
         }
@@ -846,6 +846,11 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
             /* skip all data */
             while ((i = (unsigned char)stream.GetC()) != 0)
             {
+                if (stream.Eof() || (stream.LastRead() == 0))
+                {
+                    Destroy();
+                    return wxGIF_INVFORMAT;
+                }
                 stream.SeekI(i, wxFromCurrent);
             }
         }
@@ -867,19 +872,24 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
                 wxFileOffset pos = stream.TellI();
                 wxFileOffset numBytes = 3 * local_ncolors;
                 stream.SeekI(numBytes, wxFromCurrent);
-                if (stream.TellI() != (pos + numBytes))
-                {
-                    Destroy();
-                    return wxGIF_INVFORMAT;
-                }
             }
 
             /* initial code size */
             (void) stream.GetC();
+            if (stream.Eof() || (stream.LastRead() == 0))
+            {
+                Destroy();
+                return wxGIF_INVFORMAT;
+            }
 
             /* skip all data */
             while ((i = (unsigned char)stream.GetC()) != 0)
             {
+                if (stream.Eof() || (stream.LastRead() == 0))
+                {
+                    Destroy();
+                    return wxGIF_INVFORMAT;
+                }
                 stream.SeekI(i, wxFromCurrent);
             }
         }