Merge branch '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-2 into 4.7-integration

* '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-2: (24 commits)
  Stabilize tst_QGraphicsWidget::QT_BUG_13865_doublePaintWhenAddingASubItem
  Fixed accessing freed memory in raster engine.
  Build fix for -qtnamespace.
  Fixed parsing of SVGs with absolute font sizes.
  Moving QPdf::stripSpecialCharacter to fontengine
  Revert "Fix (implement!) hfw/wfh in QGridLayoutEngine"
  Fixed a layout issue where you could get NaN as dimensions
  QTextCodec:  Fix valgrind warning when using QTextCodec in destructions functions
  Fix double painting when adding an item into a linear layout
  Fixed antialiased rasterization bug in raster engine.
  Fixed potential crash when loading corrupt GIFs.
  Work around an ATI driver problem with mutli-sampled pbuffers.
  tst_qstatemachine.cpp: fix compilation with Sun Studio
  Fixed regression in clipping.qps autotest on 64-bit.
  Fixed crash when using Qt::WA_DeleteOnClose on a QPrintDialog on Mac.
  Fixed performance regression in curve stroking.
  Don't disable texture_from_pixmap on GLX/X11 by default.
  Avoid creating copy of an image in memory when storing as png
  Doc update for the support of MSVC 2010 64-bit
  fix documentation of drawText(int, int, int, int, ...
  ...

1 files changed, 11 insertions, 2 deletions

diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
index 124d27b..a050baf 100644
--- a/src/gui/image/qgifhandler.cpp
+++ b/src/gui/image/qgifhandler.cpp
@@ -505,17 +505,26 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
                             code=oldcode;
                         }
                         while (code>=clear_code+2) {
+                            if (code >= max_code) {
+                                state = Error;
+                                return -1;
+                            }
                             *sp++=table[1][code];
                             if (code==table[0][code]) {
                                 state=Error;
-                                break;
+                                return -1;
                             }
                             if (sp-stack>=(1<<(max_lzw_bits))*2) {
                                 state=Error;
-                                break;
+                                return -1;
                             }
                             code=table[0][code];
                         }
+                        if (code < 0) {
+                            state = Error;
+                            return -1;
+                        }
+
                         *sp++=firstcode=table[1][code];
                         code=max_code;
                         if (code<(1<<max_lzw_bits)) {