nsgifload: check dimensions before memory allocation
GIF dimensions are 16-bit unsigned Initialise memory to zero as image may be truncated
This commit is contained in:
parent
0054c7dafa
commit
744e42edd1
|
@ -534,10 +534,17 @@ vips_foreign_load_nsgif_class_init( VipsForeignLoadNsgifClass *class )
|
||||||
static void *
|
static void *
|
||||||
vips_foreign_load_nsgif_bitmap_create( int width, int height )
|
vips_foreign_load_nsgif_bitmap_create( int width, int height )
|
||||||
{
|
{
|
||||||
/* ensure a stupidly large bitmap is not created
|
/* Check GIF dimensions fit within 16-bit unsigned.
|
||||||
*/
|
*/
|
||||||
|
if( width <= 0 ||
|
||||||
return calloc( width * height, 4 );
|
width > 65535 ||
|
||||||
|
height <= 0 ||
|
||||||
|
height > 65535 ) {
|
||||||
|
vips_error( "gifload",
|
||||||
|
"%s", _( "dimensions out of range ") );
|
||||||
|
return( NULL );
|
||||||
|
}
|
||||||
|
return g_malloc0( width * height * 4 );
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
|
@ -569,7 +576,7 @@ static void
|
||||||
vips_foreign_load_nsgif_bitmap_destroy( void *bitmap )
|
vips_foreign_load_nsgif_bitmap_destroy( void *bitmap )
|
||||||
{
|
{
|
||||||
g_assert( bitmap );
|
g_assert( bitmap );
|
||||||
free( bitmap );
|
g_free( bitmap );
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
|
|
Loading…
Reference in New Issue