procyberian/emacs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

* image.c (gif_load): Check that subimages fit.

Browse source 
Fixes: debbugs:14345
This commit is contained in:
Paul Eggert 2013-05-12 12:17:04 -07:00
parent 4506f5e652
commit 44aa9ee6d2
2 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/ChangeLog
View file

@ -1,3 +1,7 @@
2013-05-12 Paul Eggert <eggert@cs.ucla.edu>
* image.c (gif_load): Check that subimages fit (Bug#14345).
2013-05-09 Stefan Monnier <monnier@iro.umontreal.ca>
* lread.c (skip_dyn_eof): New function.

19
src/image.c
View file

@ -7263,6 +7263,25 @@ gif_load (struct frame *f, struct image *img)
return 0;
}
/* Check that the selected subimages fit. It's not clear whether
the GIF spec requires this, but Emacs can crash if they don't fit. */
for (j = 0; j <= idx; ++j)
{
struct SavedImage *subimage = gif->SavedImages + j;
int subimg_width = subimage->ImageDesc.Width;
int subimg_height = subimage->ImageDesc.Height;
int subimg_top = subimage->ImageDesc.Top;
int subimg_left = subimage->ImageDesc.Left;
if (! (0 <= subimg_width && 0 <= subimg_height
&& 0 <= subimg_top && subimg_top <= height - subimg_height
&& 0 <= subimg_left && subimg_left <= width - subimg_width))
{
image_error ("Subimage does not fit in image", Qnil, Qnil);
fn_DGifCloseFile (gif);
return 0;
}
}
/* Create the X image and pixmap. */
if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap))
{