solemnwarning/wxwidgets
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Fix crash when reading truncated GIF image

Browse source 
Add a unit test case checking that we don't crash any longer and still
read the image meta data correctly, even if not the image itself.

Also add another check for EOF and possibly invalid "bits" value in
another place where we were not checking for it when reading from the
stream.

Closes #23409.

Co-authored-by: PB <PBfordev@gmail.com>
This commit is contained in:
Vadim Zeitlin 2023-07-02 17:30:50 +01:00
parent e5e37d9878
commit c2e5749443
7 changed files with 64 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/common/gifdecod.cpp
View file

@ -305,8 +305,9 @@ int wxGIFDecoder::getcode(wxInputStream& stream, int bits, int ab_fin)
* an end-of-image symbol (ab_fin) they come up with
* a zero-length subblock!! We catch this here so
* that the decoder sees an ab_fin code.
* We also need to check if the file doesn't end unexpectedly.
*/
if (m_restbyte == 0)
if (stream.Eof() || m_restbyte == 0)
{
code = ab_fin;
break;
@ -860,7 +861,7 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
// get initial code size from first byte in raster data
bits = stream.GetC();
if (bits == 0)
if (stream.Eof() || bits <= 0)
return wxGIF_INVFORMAT;
// decode image