Mercurial > hg > release > icedtea6-1.2

view patches/icedtea-6804997.patch @ 880:2b66e5f1a1de default tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add last two batches of security patches.
author andrew
date Mon, 29 Mar 2010 22:00:07 +0100
parents
children
line wrap: on
line source

--- old/src/share/native/sun/awt/giflib/dgif_lib.c	Thu Mar  5 16:33:17 2009
+++ openjdk/jdk/src/share/native/sun/awt/giflib/dgif_lib.c	Thu Mar  5 16:33:16 2009
@@ -722,6 +722,10 @@
     GifFilePrivateType *Private = (GifFilePrivateType *)GifFile->Private;
 
     READ(GifFile, &CodeSize, 1);    /* Read Code size from file. */
+    if (CodeSize >= 12) {
+        /* Invalid initial code size: report failure */
+        return GIF_ERROR;
+    }
     BitsPerPixel = CodeSize;
 
     Private->Buf[0] = 0;    /* Input Buffer empty. */
@@ -964,10 +968,13 @@
 
     /* If code cannot fit into RunningBits bits, must raise its size. Note
      * however that codes above 4095 are used for special signaling.  */
-    if (++Private->RunningCode > Private->MaxCode1 &&
-        Private->RunningBits < LZ_BITS) {
-        Private->MaxCode1 <<= 1;
-        Private->RunningBits++;
+    if (++Private->RunningCode > Private->MaxCode1) {
+        if (Private->RunningBits < LZ_BITS) {
+            Private->MaxCode1 <<= 1;
+            Private->RunningBits++;
+        } else {
+            Private->RunningCode = Private->MaxCode1;
+        }
     }
     return GIF_OK;
 }