[Libreoffice-commits] core.git: Branch 'libreoffice-4-4' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif |binary
 vcl/source/filter/igif/decode.cxx                      |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit 6bdca73d186ab1c01129c094acaa8b261e092fcc
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jul 11 15:31:19 2015 +0100

    fix gif import crash
    
    Change-Id: I3a5e0efef6843fb8f8b485fa2369ac5b99513c31
    (cherry picked from commit 839e051c658a638a259be6a6bb091b654fac405f)
    Reviewed-on: https://gerrit.libreoffice.org/16954
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif
new file mode 100644
index 0000000..860f9e1
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif differ
diff --git a/vcl/source/filter/igif/decode.cxx b/vcl/source/filter/igif/decode.cxx
index d50ac7c..4d278d9 100644
--- a/vcl/source/filter/igif/decode.cxx
+++ b/vcl/source/filter/igif/decode.cxx
@@ -197,6 +197,8 @@ bool GIFLZWDecompressor::ProcessOneCode()
         pE = pTable + nCode;
         do
         {
+            if (pOutBufData == pOutBuf) //can't go back past start
+                return false;
             nOutBufDataLen++;
             *(--pOutBufData) = pE->nData;
             pE = pE->pPrev;