changeset 1176:51f13571014c

6804997: JWS GIF Decoding Heap Corruption [V-r687oxuocp] Reviewed-by: prr
author bae
date Fri, 06 Mar 2009 12:40:38 +0300
parents 7f6c1ce75629
children 2e34ef54a93a 21e38c573956 8cdfcdea53cb 13dfb2c46091 8062f8c51a88 3265fb461090
files src/share/native/sun/awt/giflib/dgif_lib.c
diffstat 1 files changed, 11 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/src/share/native/sun/awt/giflib/dgif_lib.c	Thu Mar 05 19:36:51 2009 +0300
+++ b/src/share/native/sun/awt/giflib/dgif_lib.c	Fri Mar 06 12:40:38 2009 +0300
@@ -722,6 +722,10 @@
     GifFilePrivateType *Private = (GifFilePrivateType *)GifFile->Private;
 
     READ(GifFile, &CodeSize, 1);    /* Read Code size from file. */
+    if (CodeSize >= 12) {
+        /* Invalid initial code size: report failure */
+        return GIF_ERROR;
+    }
     BitsPerPixel = CodeSize;
 
     Private->Buf[0] = 0;    /* Input Buffer empty. */
@@ -964,10 +968,13 @@
 
     /* If code cannot fit into RunningBits bits, must raise its size. Note
      * however that codes above 4095 are used for special signaling.  */
-    if (++Private->RunningCode > Private->MaxCode1 &&
-        Private->RunningBits < LZ_BITS) {
-        Private->MaxCode1 <<= 1;
-        Private->RunningBits++;
+    if (++Private->RunningCode > Private->MaxCode1) {
+        if (Private->RunningBits < LZ_BITS) {
+            Private->MaxCode1 <<= 1;
+            Private->RunningBits++;
+        } else {
+            Private->RunningCode = Private->MaxCode1;
+        }
     }
     return GIF_OK;
 }