Merge branch '8.10' of github.com:libvips/libvips into 8.10

ChangeLog

@@ -10,6 +10,7 @@
 - better GraphicsMagick image write [bfriesen]
 - add missing read loops to spng, heif, giflib and ppm load [kleisauke]
 - block zero width or height images from imagemagick load [Koen1999]
+- check for overflow in gifload height [lovell]
 - fix msb_first default in ppm load [ewelot]
 
 6/9/20 started 8.10.2

libvips/foreign/gifload.c

@@ -700,8 +700,16 @@ vips_foreign_load_gif_scan_extension( VipsForeignLoadGif *gif )
 static int
 vips_foreign_load_gif_set_header( VipsForeignLoadGif *gif, VipsImage *image )
 {
+	const gint64 total_height = (gint64) gif->file->SHeight * gif->n;
+
+	if( total_height <= 0 || 
+		total_height > VIPS_MAX_COORD ) {
+		vips_error( "gifload", "%s", _( "image size out of bounds" ) );
+		return( -1 );
+	}
+
 	vips_image_init_fields( image,
-		gif->file->SWidth, gif->file->SHeight * gif->n,
+		gif->file->SWidth, total_height,
 		(gif->has_colour ? 3 : 1) + (gif->has_transparency ? 1 : 0),
 		VIPS_FORMAT_UCHAR, VIPS_CODING_NONE,
 		gif->has_colour ?

libvips/foreign/magick7load.c

@@ -454,7 +454,7 @@ vips_foreign_load_magick7_parse( VipsForeignLoadMagick7 *magick7,
 		out->Bands <= 0 ||
 		out->Xsize >= VIPS_MAX_COORD ||
 		out->Ysize >= VIPS_MAX_COORD ||
-		out->Bands >= VIPS_MAX_COORD ) ||
+		out->Bands >= VIPS_MAX_COORD ) {
 		vips_error( class->nickname, 
 			_( "bad image dimensions %d x %d pixels, %d bands" ),
 			out->Xsize, out->Ysize, out->Bands );