dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-04-04 16:06:49 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

gifdec,Remap: avoid out of bounds colormap read

Browse Source 
sanitize the requested length to be read against the reported size of
the table

BUG=webp:316

Change-Id: I1c471e93ab696a9d21a0142cf1987ffcf8f55dd2
This commit is contained in:
James Zern 2016-10-31 12:56:04 -07:00
parent 31b1e34342
commit f048d38d38
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
examples/gifdec.c
View File

@ -87,7 +87,8 @@ static void Remap(const GifFileType* const gif, const uint8_t* const src,
const GifColorType* colors; const GifColorType* colors;
const ColorMapObject* const cmap = const ColorMapObject* const cmap =
gif->Image.ColorMap ? gif->Image.ColorMap : gif->SColorMap; gif->Image.ColorMap ? gif->Image.ColorMap : gif->SColorMap;
if (cmap == NULL) return; if (cmap == NULL || cmap->Colors == NULL) return;
if (len > cmap->ColorCount) len = cmap->ColorCount;
colors = cmap->Colors; colors = cmap->Colors;
for (i = 0; i < len; ++i) { for (i = 0; i < len; ++i) {