diff options
| author | Lars Ingebrigtsen <larsi@gnus.org> | 2022-04-12 15:11:09 +0200 |
|---|---|---|
| committer | Lars Ingebrigtsen <larsi@gnus.org> | 2022-04-12 15:11:32 +0200 |
| commit | 4a108df0ebb68e9ea1073d53c14d8f897e43f21c (patch) | |
| tree | 69f855f8396bd7408a2047899c3eddc8aec22653 /src/image.c | |
| parent | 00071c976f9a16b5684697d10b086fc1b0be7145 (diff) | |
| download | emacs-4a108df0ebb68e9ea1073d53c14d8f897e43f21c.tar.gz emacs-4a108df0ebb68e9ea1073d53c14d8f897e43f21c.tar.bz2 emacs-4a108df0ebb68e9ea1073d53c14d8f897e43f21c.zip | |
Fix check for whether frames fit into gif images
* src/image.c (gif_load): Really check all frames that they fit.
Diffstat (limited to 'src/image.c')
| -rw-r--r-- | src/image.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/image.c b/src/image.c index b6edcf96a0b..3afb8324078 100644 --- a/src/image.c +++ b/src/image.c @@ -8937,16 +8937,19 @@ gif_load (struct frame *f, struct image *img) /* Check that the selected subimages fit. It's not clear whether the GIF spec requires this, but Emacs can crash if they don't fit. */ - for (j = 0; j <= idx; ++j) + for (j = 0; j < gif->ImageCount; ++j) { struct SavedImage *subimage = gif->SavedImages + j; int subimg_width = subimage->ImageDesc.Width; int subimg_height = subimage->ImageDesc.Height; int subimg_top = subimage->ImageDesc.Top; int subimg_left = subimage->ImageDesc.Left; - if (! (subimg_width >= 0 && subimg_height >= 0 - && 0 <= subimg_top && subimg_top <= height - subimg_height - && 0 <= subimg_left && subimg_left <= width - subimg_width)) + if (subimg_width < 0 + || subimg_height < 0 + || subimg_top < 0 + || subimg_left < 0 + || subimg_top + subimg_height > height + || subimg_left + subimg_width > width) { image_error ("Subimage does not fit in image"); goto gif_error; |