[Libreoffice-commits] core.git: Branch 'libreoffice-4-2' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/gif/pass/sf_3e0068c9b19bb548826bed0599f65745-15940-minimized.gif |binary
 vcl/source/filter/igif/decode.cxx                                                                  |   11 ++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

New commits:
commit 902436078cb8df65d06617d5980cd8834ec8f8c9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Aug 13 09:12:26 2014 +0100

    valgrind + bff: don't add 0xffff oldcode
    
    Invalid read of size 1
       at 0x9DC6247: GIFLZWDecompressor::AddToTable(unsigned short, unsigned short) (decode.cxx:117)
    
    Change-Id: I9cea8dcd4a5eeaa1e793b9be96f82854b9d088af
    Reviewed-on: https://gerrit.libreoffice.org/10906
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/pass/sf_3e0068c9b19bb548826bed0599f65745-15940-minimized.gif b/vcl/qa/cppunit/graphicfilter/data/gif/pass/sf_3e0068c9b19bb548826bed0599f65745-15940-minimized.gif
new file mode 100644
index 0000000..47f5d43
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/gif/pass/sf_3e0068c9b19bb548826bed0599f65745-15940-minimized.gif differ
diff --git a/vcl/source/filter/igif/decode.cxx b/vcl/source/filter/igif/decode.cxx
index bf29328..5900b4c 100644
--- a/vcl/source/filter/igif/decode.cxx
+++ b/vcl/source/filter/igif/decode.cxx
@@ -166,10 +166,13 @@ bool GIFLZWDecompressor::ProcessOneCode()
         }
         else if ( ( nCode > nEOICode ) && ( nCode <= nTableSize ) )
         {
-            if ( nCode == nTableSize )
-                AddToTable( nOldCode, nOldCode );
-            else
-                AddToTable( nOldCode, nCode );
+            if ( nOldCode != 0xffff )
+            {
+                if ( nCode == nTableSize )
+                    AddToTable( nOldCode, nOldCode );
+                else
+                    AddToTable( nOldCode, nCode );
+            }
         }
         else
         {