Commit 44aa9ee6 authored by Paul Eggert's avatar Paul Eggert
Browse files

* image.c (gif_load): Check that subimages fit.

Fixes: debbugs:14345
parent 4506f5e6
2013-05-12 Paul Eggert <eggert@cs.ucla.edu>
* image.c (gif_load): Check that subimages fit (Bug#14345).
2013-05-09 Stefan Monnier <monnier@iro.umontreal.ca>
* lread.c (skip_dyn_eof): New function.
......
......@@ -7263,6 +7263,25 @@ gif_load (struct frame *f, struct image *img)
return 0;
}
/* Check that the selected subimages fit. It's not clear whether
the GIF spec requires this, but Emacs can crash if they don't fit. */
for (j = 0; j <= idx; ++j)
{
struct SavedImage *subimage = gif->SavedImages + j;
int subimg_width = subimage->ImageDesc.Width;
int subimg_height = subimage->ImageDesc.Height;
int subimg_top = subimage->ImageDesc.Top;
int subimg_left = subimage->ImageDesc.Left;
if (! (0 <= subimg_width && 0 <= subimg_height
&& 0 <= subimg_top && subimg_top <= height - subimg_height
&& 0 <= subimg_left && subimg_left <= width - subimg_width))
{
image_error ("Subimage does not fit in image", Qnil, Qnil);
fn_DGifCloseFile (gif);
return 0;
}
}
/* Create the X image and pixmap. */
if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap))
{
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment