sergiotarxz/libvips
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

try delaying libnsgif alloc until read frame

Browse Source 
gives the caller a chance to detect memory bombs
This commit is contained in:
John Cupitt 2021-04-01 12:53:57 +01:00
parent e4453f8b18
commit 9bdf5e8cda
1 changed files with 16 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
libvips/foreign/libnsgif/libnsgif.c
View File

@ -79,34 +79,17 @@ gif_initialise_sprite(gif_animation *gif,
unsigned int width, unsigned int width,
unsigned int height) unsigned int height)
{ {
unsigned int max_width; /* Already allocated? */
unsigned int max_height; if (gif->frame_image) {
struct bitmap *buffer;
/* Check if we've changed */
if ((width <= gif->width) && (height <= gif->height)) {
return GIF_OK; return GIF_OK;
} }
/* Get our maximum values */
max_width = (width > gif->width) ? width : gif->width;
max_height = (height > gif->height) ? height : gif->height;
/* Allocate some more memory */
assert(gif->bitmap_callbacks.bitmap_create); assert(gif->bitmap_callbacks.bitmap_create);
buffer = gif->bitmap_callbacks.bitmap_create(max_width, max_height); gif->frame_image = gif->bitmap_callbacks.bitmap_create(width, height);
if (buffer == NULL) { if (gif->frame_image == NULL) {
return GIF_INSUFFICIENT_MEMORY; return GIF_INSUFFICIENT_MEMORY;
} }
assert(gif->bitmap_callbacks.bitmap_destroy);
gif->bitmap_callbacks.bitmap_destroy(gif->frame_image);
gif->frame_image = buffer;
gif->width = max_width;
gif->height = max_height;
/* Invalidate our currently decoded image */
gif->decoded_frame = GIF_INVALID_FRAME;
return GIF_OK; return GIF_OK;
} }
@ -392,10 +375,12 @@ static gif_result gif_initialise_frame(gif_animation *gif)
gif->frames[frame].redraw_required = ((gif->frames[frame].disposal_method == GIF_FRAME_CLEAR) || gif->frames[frame].redraw_required = ((gif->frames[frame].disposal_method == GIF_FRAME_CLEAR) ||
(gif->frames[frame].disposal_method == GIF_FRAME_RESTORE)); (gif->frames[frame].disposal_method == GIF_FRAME_RESTORE));
/* Boundary checking - shouldn't ever happen except with junk data */ /* Frame size may have grown.
if (gif_initialise_sprite(gif, (offset_x + width), (offset_y + height))) { */
return GIF_INSUFFICIENT_MEMORY; gif->width = (offset_x + width > gif->width) ?
} offset_x + width : gif->width;
gif->height = (offset_y + height > gif->height) ?
offset_y + height : gif->height;
/* Decode the flags */ /* Decode the flags */
flags = gif_data[9]; flags = gif_data[9];
@ -739,6 +724,12 @@ gif_internal_decode_frame(gif_animation *gif,
goto gif_decode_frame_exit; goto gif_decode_frame_exit;
} }
/* Make sure we have a buffer to decode to.
*/
if (gif_initialise_sprite(gif, gif->width, gif->height)) {
return GIF_INSUFFICIENT_MEMORY;
}
/* Decode the flags */ /* Decode the flags */
flags = gif_data[9]; flags = gif_data[9];
colour_table_size = 2 << (flags & GIF_COLOUR_TABLE_SIZE_MASK); colour_table_size = 2 << (flags & GIF_COLOUR_TABLE_SIZE_MASK);