Catch invalid frame dimensions.

	* io-gif.c (gif_get_frame_info): Catch invalid frame dimensions.

diff --git a/gdk-pixbuf/ChangeLog b/gdk-pixbuf/ChangeLog
index 494890123b8c01100644c01431c5805a5a89629b..ebf30d0870177bc74a100db0fe33dc5b4f4ddd1d 100644 (file)
--- a/gdk-pixbuf/ChangeLog
+++ b/gdk-pixbuf/ChangeLog
@@ -1,3 +1,7 @@
+2002-03-15  Matthias Clasen  <maclas@gmx.de>
+
+       * io-gif.c (gif_get_frame_info): Catch invalid frame dimensions.
+
 2002-03-13  Matthias Clasen  <maclas@gmx.de>
 
        * test-images.h: Add valid_ras_test and invalid_bmp_1.

diff --git a/gdk-pixbuf/io-gif.c b/gdk-pixbuf/io-gif.c
index c01a58ff078645bca62cfe12ced4355f7f9047e4..a5cab7a46900d9c399c438dd342981a671a61258 100644 (file)
--- a/gdk-pixbuf/io-gif.c
+++ b/gdk-pixbuf/io-gif.c
@@ -1135,6 +1135,17 @@ gif_get_frame_info (GifContext *context)
        context->x_offset = LM_to_uint (buf[0], buf[1]);
        context->y_offset = LM_to_uint (buf[2], buf[3]);
 
+        if ((context->frame_height == 0) || (context->frame_len == 0)) {
+               context->state = GIF_DONE;
+
+                g_set_error (context->error,
+                             GDK_PIXBUF_ERROR,
+                             GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
+                             _("GIF image contained a frame with height or width 0."));
+                
+               return -2;
+        }
+            
        if (((context->frame_height + context->y_offset) > context->height) ||
             ((context->frame_len + context->x_offset) > context->width)) {
                /* All frames must fit in the image bounds */