Merge changes from CUPS 1.4svn-r7696.

[thirdparty/cups.git] / filter / image-gif.c

diff --git a/filter/image-gif.c b/filter/image-gif.c
index 863625a9e6436d0b2f6379070ba131ce647ecd86..caa39439e99c0a9a7f9f343bc14105a286ef6bc4 100644 (file)
--- a/filter/image-gif.c
+++ b/filter/image-gif.c
@@ -1,25 +1,16 @@
 /*
- * "$Id: image-gif.c 6420 2007-03-30 20:00:59Z mike $"
+ * "$Id: image-gif.c 7420 2008-04-01 20:32:00Z mike $"
  *
  *   GIF image routines for the Common UNIX Printing System (CUPS).
  *
+ *   Copyright 2007-2008 by Apple Inc.
  *   Copyright 1993-2007 by Easy Software Products.
  *
  *   These coded instructions, statements, and computer programs are the
- *   property of Easy Software Products and are protected by Federal
- *   copyright law.  Distribution and use rights are outlined in the file
- *   "LICENSE.txt" which should have been included with this file.  If this
- *   file is missing or damaged please contact Easy Software Products
- *   at:
- *
- *       Attn: CUPS Licensing Information
- *       Easy Software Products
- *       44141 Airport View Drive, Suite 204
- *       Hollywood, Maryland 20636 USA
- *
- *       Voice: (301) 373-9600
- *       EMail: cups-info@cups.org
- *         WWW: http://www.cups.org
+ *   property of Apple Inc. and are protected by Federal copyright
+ *   law.  Distribution and use rights are outlined in the file "LICENSE.txt"
+ *   which should have been included with this file.  If this file is
+ *   file is missing or damaged, see the license at "http://www.cups.org/".
  *
  *   This file is subject to the Apple OS-Developed Software exception.
  *
@@ -46,6 +37,7 @@
 
 #define GIF_INTERLACE  0x40
 #define GIF_COLORMAP   0x80
+#define GIF_MAX_BITS   12
 
 typedef cups_ib_t      gif_cmap_t[256][4];
 typedef short          gif_table_t[4096];
@@ -471,8 +463,14 @@ gif_read_image(FILE         *fp,   /* I - Input file */
   pass      = 0;
   code_size = getc(fp);
 
+  if (code_size > GIF_MAX_BITS || !pixels)
+    return (-1);
+
   if (gif_read_lzw(fp, 1, code_size) < 0)
+  {
+    free(pixels);
     return (-1);
+  }
 
   temp = pixels;
   while ((pixel = gif_read_lzw(fp, 0, code_size)) >= 0)
@@ -695,5 +693,5 @@ gif_read_lzw(FILE *fp,                      /* I - File to read from */
 
 
 /*
- * End of "$Id: image-gif.c 6420 2007-03-30 20:00:59Z mike $".
+ * End of "$Id: image-gif.c 7420 2008-04-01 20:32:00Z mike $".
  */