[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif |binary
 vcl/source/filter/igif/decode.cxx                      |    3 +++
 2 files changed, 3 insertions(+)

New commits:
commit b657d6c484ed75f7db4497c720caaffcc519b88c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jul 12 10:56:48 2015 +0100

    fix another gif import crash
    
    Change-Id: I0ffa569e0c4240e11184df7dd56b95d87a12425d
    (cherry picked from commit ee35b72064d8d1333709b102b051360018f8044b)
    Reviewed-on: https://gerrit.libreoffice.org/16961
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif
new file mode 100644
index 0000000..b7265f8
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-2.gif differ
diff --git a/vcl/source/filter/igif/decode.cxx b/vcl/source/filter/igif/decode.cxx
index 46a666f..105eab9 100644
--- a/vcl/source/filter/igif/decode.cxx
+++ b/vcl/source/filter/igif/decode.cxx
@@ -193,6 +193,9 @@ bool GIFLZWDecompressor::ProcessOneCode()
 
         nOldCode = nCode;
 
+        if (nCode > 4096)
+            return false;
+
         // write character(/-sequence) of code nCode in the output buffer:
         pE = pTable + nCode;
         do