Преглед на файлове

libobs/graphics: Prevent heap overflow in libnsgif

See upstream commit:
https://source.netsurf-browser.org/libnsgif.git/commit/?id=a268d2c15252ac58c19f1b19771822c66bcf73b2
Ryan Foster преди 1 година
родител
ревизия
02c1742b30
променени са 1 файла, в които са добавени 17 реда и са изтрити 0 реда
  1. 17 0
      libobs/graphics/libnsgif/libnsgif.c

+ 17 - 0
libobs/graphics/libnsgif/libnsgif.c

@@ -1183,6 +1183,10 @@ static bool gif_next_LZW(gif_animation *gif) {
 
     incode = code;
     if (code >= gif->max_code) {
+        if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
+            gif->current_error = GIF_FRAME_DATA_ERROR;
+            return false;
+        }
         *gif->stack_pointer++ = gif->firstcode;
         code = gif->oldcode;
     }
@@ -1192,12 +1196,21 @@ static bool gif_next_LZW(gif_animation *gif) {
      *
      * Note: our gif->stack is always big enough to hold a complete decompressed chunk. */
     while (code >= gif->clear_code) {
+        if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
+            gif->current_error = GIF_FRAME_DATA_ERROR;
+            return false;
+        }
         *gif->stack_pointer++ = gif->table[1][code];
         new_code = gif->table[0][code];
         if (new_code < gif->clear_code) {
             code = new_code;
             break;
         }
+
+        if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
+            gif->current_error = GIF_FRAME_DATA_ERROR;
+            return false;
+        }
         *gif->stack_pointer++ = gif->table[1][new_code];
         code = gif->table[0][new_code];
         if (code == new_code) {
@@ -1206,6 +1219,10 @@ static bool gif_next_LZW(gif_animation *gif) {
         }
     }
 
+    if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
+        gif->current_error = GIF_FRAME_DATA_ERROR;
+        return false;
+    }
     *gif->stack_pointer++ = gif->firstcode = gif->table[1][code];
 
     if ((code = gif->max_code) < (1 << GIF_MAX_LZW)) {