vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif |binary vcl/source/filter/igif/decode.cxx | 2 ++ 2 files changed, 2 insertions(+)
New commits: commit 6bdca73d186ab1c01129c094acaa8b261e092fcc Author: Caolán McNamara <caol...@redhat.com> Date: Sat Jul 11 15:31:19 2015 +0100 fix gif import crash Change-Id: I3a5e0efef6843fb8f8b485fa2369ac5b99513c31 (cherry picked from commit 839e051c658a638a259be6a6bb091b654fac405f) Reviewed-on: https://gerrit.libreoffice.org/16954 Reviewed-by: David Tardon <dtar...@redhat.com> Tested-by: David Tardon <dtar...@redhat.com> diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif new file mode 100644 index 0000000..860f9e1 Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif differ diff --git a/vcl/source/filter/igif/decode.cxx b/vcl/source/filter/igif/decode.cxx index d50ac7c..4d278d9 100644 --- a/vcl/source/filter/igif/decode.cxx +++ b/vcl/source/filter/igif/decode.cxx @@ -197,6 +197,8 @@ bool GIFLZWDecompressor::ProcessOneCode() pE = pTable + nCode; do { + if (pOutBufData == pOutBuf) //can't go back past start + return false; nOutBufDataLen++; *(--pOutBufData) = pE->nData; pE = pE->pPrev;
_______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/libreoffice-commits