diff options
Diffstat (limited to 'src/image.c')
| -rw-r--r-- | src/image.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/src/image.c b/src/image.c index 2dae63a294f..f9f6ce70040 100644 --- a/src/image.c +++ b/src/image.c @@ -7263,6 +7263,25 @@ gif_load (struct frame *f, struct image *img) return 0; } + /* Check that the selected subimages fit. It's not clear whether + the GIF spec requires this, but Emacs can crash if they don't fit. */ + for (j = 0; j <= idx; ++j) + { + struct SavedImage *subimage = gif->SavedImages + j; + int subimg_width = subimage->ImageDesc.Width; + int subimg_height = subimage->ImageDesc.Height; + int subimg_top = subimage->ImageDesc.Top; + int subimg_left = subimage->ImageDesc.Left; + if (! (0 <= subimg_width && 0 <= subimg_height + && 0 <= subimg_top && subimg_top <= height - subimg_height + && 0 <= subimg_left && subimg_left <= width - subimg_width)) + { + image_error ("Subimage does not fit in image", Qnil, Qnil); + fn_DGifCloseFile (gif); + return 0; + } + } + /* Create the X image and pixmap. */ if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap)) { |