|
@@ -1183,6 +1183,10 @@ static bool gif_next_LZW(gif_animation *gif) {
|
|
|
|
|
|
incode = code;
|
|
|
if (code >= gif->max_code) {
|
|
|
+ if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
|
|
|
+ gif->current_error = GIF_FRAME_DATA_ERROR;
|
|
|
+ return false;
|
|
|
+ }
|
|
|
*gif->stack_pointer++ = gif->firstcode;
|
|
|
code = gif->oldcode;
|
|
|
}
|
|
@@ -1192,12 +1196,21 @@ static bool gif_next_LZW(gif_animation *gif) {
|
|
|
*
|
|
|
* Note: our gif->stack is always big enough to hold a complete decompressed chunk. */
|
|
|
while (code >= gif->clear_code) {
|
|
|
+ if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
|
|
|
+ gif->current_error = GIF_FRAME_DATA_ERROR;
|
|
|
+ return false;
|
|
|
+ }
|
|
|
*gif->stack_pointer++ = gif->table[1][code];
|
|
|
new_code = gif->table[0][code];
|
|
|
if (new_code < gif->clear_code) {
|
|
|
code = new_code;
|
|
|
break;
|
|
|
}
|
|
|
+
|
|
|
+ if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
|
|
|
+ gif->current_error = GIF_FRAME_DATA_ERROR;
|
|
|
+ return false;
|
|
|
+ }
|
|
|
*gif->stack_pointer++ = gif->table[1][new_code];
|
|
|
code = gif->table[0][new_code];
|
|
|
if (code == new_code) {
|
|
@@ -1206,6 +1219,10 @@ static bool gif_next_LZW(gif_animation *gif) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
+ if (gif->stack_pointer >= gif->stack + ((1 << GIF_MAX_LZW) * 2)) {
|
|
|
+ gif->current_error = GIF_FRAME_DATA_ERROR;
|
|
|
+ return false;
|
|
|
+ }
|
|
|
*gif->stack_pointer++ = gif->firstcode = gif->table[1][code];
|
|
|
|
|
|
if ((code = gif->max_code) < (1 << GIF_MAX_LZW)) {
|