Merge changes from CUPS 1.4svn-r7394.

[thirdparty/cups.git] / filter / image-gif.c

diff --git a/filter/image-gif.c b/filter/image-gif.c
index a391811fcdbcb5de451e671ab1496f911e334f38..d78670d37604aa91cf3f1b1062b515537303eb4d 100644 (file)
--- a/filter/image-gif.c
+++ b/filter/image-gif.c
@@ -37,6 +37,7 @@
 
 #define GIF_INTERLACE  0x40
 #define GIF_COLORMAP   0x80
+#define GIF_MAX_BITS   12
 
 typedef cups_ib_t      gif_cmap_t[256][4];
 typedef short          gif_table_t[4096];
@@ -462,7 +463,7 @@ gif_read_image(FILE         *fp,    /* I - Input file */
   pass      = 0;
   code_size = getc(fp);
 
-  if (!pixels)
+  if (code_size > GIF_MAX_BITS || !pixels)
     return (-1);
 
   if (gif_read_lzw(fp, 1, code_size) < 0)