Bug#408929: emacs21: crash on spam

[Romain Francoise]

reassign 408929 emacs21
tags 408929 patch
quit

This is a known bug in the way Emacs computes the size of some GIF
images; the attached patch (adapted from a similar change in CVS)
fixes the crash for me.

Thanks,

-- 
  ,''`.
 : :' :        Romain Francoise <[EMAIL PROTECTED]>
 `. `'         http://people.debian.org/~rfrancoise/
   `-

--- emacs21-21.4a+1.orig/src/xfns.c
+++ emacs21-21.4a+1/src/xfns.c
@@ -9805,8 +9805,17 @@
       return 0;
     }
 
-  width = img->width = max (gif->SWidth, gif->Image.Left + gif->Image.Width);
-  height = img->height = max (gif->SHeight, gif->Image.Top + gif->Image.Height);
+  image_top = gif->SavedImages[ino].ImageDesc.Top;
+  image_left = gif->SavedImages[ino].ImageDesc.Left;
+  image_width = gif->SavedImages[ino].ImageDesc.Width;
+  image_height = gif->SavedImages[ino].ImageDesc.Height;
+
+  width = img->width = max (gif->SWidth,
+			    max (gif->Image.Left + gif->Image.Width,
+				 image_left + image_width));
+  height = img->height = max (gif->SHeight,
+			      max (gif->Image.Top + gif->Image.Height,
+				   image_top + image_height));
 
   /* Create the X image and pixmap.  */
   if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap))
@@ -9839,11 +9848,6 @@
      requires more than can be done here (see the gif89 spec,
      disposal methods).  Let's simply assume that the part
      not covered by a sub-image is in the frame's background color.  */
-  image_top = gif->SavedImages[ino].ImageDesc.Top;
-  image_left = gif->SavedImages[ino].ImageDesc.Left;
-  image_width = gif->SavedImages[ino].ImageDesc.Width;
-  image_height = gif->SavedImages[ino].ImageDesc.Height;
-
   for (y = 0; y < image_top; ++y)
     for (x = 0; x < width; ++x)
       XPutPixel (ximg, x, y, FRAME_BACKGROUND_PIXEL (f));