Add checks for processing gif.

Fixes #81. Fixes #82. Some checks are added so that program exits gracefully.
These checks are added according to the gifs given by @ocean1. Some other
corrupted gif may crash at some other part of the code.
Return type of flush_tile() function is changed to int.

diff --git a/.gitignore b/.gitignore
index 87292cf94035c6eff455b70a1d2a99ac8f792f91..53be45946c1a74ef29e87331ab6494b21df87f55 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -96,3 +96,4 @@ testdither
 testimage
 testrgb
 ttfread
+.vscode/

diff --git a/cupsfilters/image-gif.c b/cupsfilters/image-gif.c
index 53cd86a523caa4dd56c2ae0293ebdf0bb4d52c6a..c225dc7098ce37d45df8c83e0f7a92d93af5227c 100644 (file)
--- a/cupsfilters/image-gif.c
+++ b/cupsfilters/image-gif.c
@@ -126,7 +126,13 @@ _cupsImageReadGIF(
               transparent = buf[3];
           }
 
-          while (gif_get_block(fp, buf) != 0);
+          while (gif_get_block(fp, buf) != 0)
+          {
+            if(gif_eof)
+            {
+              return (-1);
+            }
+          }
           break;
 
       case ',' :       /* cupsImage data */
@@ -487,8 +493,11 @@ gif_read_image(FILE         *fp,   /* I - Input file */
     temp += bpp;
     if (xpos == img->xsize)
     {
-      _cupsImagePutRow(img, 0, ypos, img->xsize, pixels);
-
+      int res = _cupsImagePutRow(img, 0, ypos, img->xsize, pixels);
+      if(res)
+      {
+        return (-1);
+      }
       xpos = 0;
       temp = pixels;
 

diff --git a/cupsfilters/image.c b/cupsfilters/image.c
index 1eb12f2f1bc69d79456c08eacbf893ef76efaf5c..ac96541be9c959c8103874b675a2ba4d8f7d7ee0 100644 (file)
--- a/cupsfilters/image.c
+++ b/cupsfilters/image.c
@@ -39,7 +39,7 @@
  * Local functions...
  */
 
-static void            flush_tile(cups_image_t *img);
+static int             flush_tile(cups_image_t *img);
 static cups_ib_t       *get_tile(cups_image_t *img, int x, int y);
 
 
@@ -614,7 +614,7 @@ cupsImageSetMaxTiles(
  * 'flush_tile()' - Flush the least-recently-used tile in the cache.
  */
 
-static void
+static int
 flush_tile(cups_image_t *img)          /* I - Image */
 {
   int          bpp;                    /* Bytes per pixel */
@@ -622,12 +622,16 @@ flush_tile(cups_image_t *img)             /* I - Image */
 
 
   bpp  = cupsImageGetDepth(img);
+  if(img==NULL||img->first==NULL||img->first->tile==NULL)
+  {
+    return -1;
+  }
   tile = img->first->tile;
 
   if (!tile->dirty)
   {
     tile->ic = NULL;
-    return;
+    return 0;
   }
 
   if (img->cachefile < 0)
@@ -637,7 +641,7 @@ flush_tile(cups_image_t *img)               /* I - Image */
     {
       tile->ic    = NULL;
       tile->dirty = 0;
-      return;
+      return 0;
     }
 
     DEBUG_printf(("Created swap file \"%s\"...\n", img->cachename));
@@ -649,7 +653,7 @@ flush_tile(cups_image_t *img)               /* I - Image */
     {
       tile->ic    = NULL;
       tile->dirty = 0;
-      return;
+      return 0;
     }
   }
   else
@@ -658,7 +662,7 @@ flush_tile(cups_image_t *img)               /* I - Image */
     {
       tile->ic    = NULL;
       tile->dirty = 0;
-      return;
+      return 0;
     }
   }
 
@@ -668,6 +672,7 @@ flush_tile(cups_image_t *img)               /* I - Image */
 
   tile->ic    = NULL;
   tile->dirty = 0;
+  return 0;
 }
 
 
@@ -743,7 +748,11 @@ get_tile(cups_image_t *img,                /* I - Image */
     {
       DEBUG_printf(("Flushing old cache tile (%p)...\n", img->first));
 
-      flush_tile(img);
+      int res = flush_tile(img);
+      if(res)
+      {
+        return NULL;
+      }
       ic = img->first;
     }