[Libreoffice-commits] core.git: Branch 'libreoffice-5-0-0' - vcl/qa vcl/source

[Caolán McNamara]

 vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif |binary
 vcl/source/filter/igif/decode.cxx                      |    2 ++
 2 files changed, 2 insertions(+)

New commits:
commit 6029d711a7af1a68ffa8d0cb0a0bd8092984f659
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jul 11 15:31:19 2015 +0100

    fix gif import crash
    
    Change-Id: I3a5e0efef6843fb8f8b485fa2369ac5b99513c31
    (cherry picked from commit 839e051c658a638a259be6a6bb091b654fac405f)
    Reviewed-on: https://gerrit.libreoffice.org/17003
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif
new file mode 100644
index 0000000..860f9e1
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/gif/pass/crash-1.gif differ
diff --git a/vcl/source/filter/igif/decode.cxx b/vcl/source/filter/igif/decode.cxx
index 46a666f..1b18f5e 100644
--- a/vcl/source/filter/igif/decode.cxx
+++ b/vcl/source/filter/igif/decode.cxx
@@ -197,6 +197,8 @@ bool GIFLZWDecompressor::ProcessOneCode()
         pE = pTable + nCode;
         do
         {
+            if (pOutBufData == pOutBuf) //can't go back past start
+                return false;
             nOutBufDataLen++;
             *(--pOutBufData) = pE->nData;
             pE = pE->pPrev;