cvs: gd(GD_2_0) /libgd gd_gif_in.c

pajoye		Sun Apr  1 19:54:17 2007 UTC

  Modified files:              (Branch: GD_2_0)
    /gd/libgd	gd_gif_in.c 
  Log:
  - #52, #60, #66
    - a frame size must be confined to the screen defition
  	- consider 00005_2 as invalid (65k x 65k frame size for a 400x312 screen)
  	- be sure to always read the dimensions in the frame and does not use
  	  the screen size (see #66 for a side effect)
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd_gif_in.c?r1=1.5.2.4&r2=1.5.2.5&diff_format=u
Index: gd/libgd/gd_gif_in.c
diff -u gd/libgd/gd_gif_in.c:1.5.2.4 gd/libgd/gd_gif_in.c:1.5.2.5
--- gd/libgd/gd_gif_in.c:1.5.2.4	Sat Mar 31 14:26:46 2007
+++ gd/libgd/gd_gif_in.c	Sun Apr  1 19:54:17 2007
@@ -143,9 +143,9 @@
        if (strncmp((char *)buf,"GIF",3) != 0) {
 		return 0;
 	}
-		if (strncmp((char *)buf+3, "87a", 3) != 0) {
+		if (memcmp((char *)buf+3, "87a", 3) == 0) {
 			gif87a = 1;
-		} else if (strncmp((char *)buf+3, "89a", 3) != 0) {
+		} else if (memcmp((char *)buf+3, "89a", 3) == 0) {
 			gif87a = 0;
 		} else {
 			return 0;
@@ -170,12 +170,15 @@
 		}
        }
        for (;;) {
+							int top, left;
+							int width, height;
+
                if (! ReadOK(fd,&c,1)) {
                        return 0;
                }
                if (c == ';') {         /* GIF terminator */
-			goto terminated;
-	       }
+								goto terminated;
+				       }
 
                if (c == '!') {         /* Extension */
                        if (! ReadOK(fd,&c,1)) {
@@ -197,17 +200,20 @@
 
                useGlobalColormap = ! BitSet(buf[8], LOCALCOLORMAP);
 
-               bitPixel = 1<<((buf[8]&0x07)+1);
-
-							 if (gif87a == 1) {
-								 imw = screen_width;
-								 imh = screen_height;
-							 } else {
-								 imw = LM_to_uint(buf[4],buf[5]);
-								 imh = LM_to_uint(buf[6],buf[7]);
-							 }
+							bitPixel = 1<<((buf[8]&0x07)+1);
+							left = LM_to_uint(buf[0], buf[1]);
+							top = LM_to_uint(buf[2], buf[3]);
+							width = LM_to_uint(buf[4], buf[5]);
+							height = LM_to_uint(buf[6], buf[7]);
+
+							if (left + width > screen_width || top + height > screen_height) {
+						 		if (VERBOSE) {
+									printf("Frame is not confined to screen dimension.\n");
+								}
+								return 0;
+							}
 
-			   if (!(im = gdImageCreate(imw, imh))) {
+			   if (!(im = gdImageCreate(width, height))) {
 				   return 0;
 			   }
 			   im->interlace = BitSet(buf[8], INTERLACE);
@@ -215,10 +221,10 @@
                        if (ReadColorMap(fd, bitPixel, localColorMap)) { 
                                  return 0;
                        }
-                       ReadImage(im, fd, imw, imh, localColorMap, 
+                       ReadImage(im, fd, width, height, localColorMap, 
                                  BitSet(buf[8], INTERLACE), &ZeroDataBlock); 
                } else {
-                       ReadImage(im, fd, imw, imh,
+                       ReadImage(im, fd, width, height,
                                  ColorMap, 
                                  BitSet(buf[8], INTERLACE), &ZeroDataBlock);
                }