diff options
| author | A-Team <ateam@pad.test.qt.nokia.com> | 2010-10-04 22:00:19 (GMT) |
|---|---|---|
| committer | A-Team <ateam@pad.test.qt.nokia.com> | 2010-10-04 22:00:19 (GMT) |
| commit | e3bcf44684aa30271c986911b328c9d9c372912a (patch) | |
| tree | de7f835e6fe69b610e64397a768f1630fb8b5c54 /src/gui/image/qgifhandler.cpp | |
| parent | f3817bc1a7bc3df360af9116dfd96f3181816472 (diff) | |
| parent | a7bf1cfb1a75c35e837c01f4a5b0697fc8961148 (diff) | |
| download | Qt-e3bcf44684aa30271c986911b328c9d9c372912a.zip Qt-e3bcf44684aa30271c986911b328c9d9c372912a.tar.gz Qt-e3bcf44684aa30271c986911b328c9d9c372912a.tar.bz2 | |
Merge branch '4.7-upstream' into 4.7-doc
Diffstat (limited to 'src/gui/image/qgifhandler.cpp')
| -rw-r--r-- | src/gui/image/qgifhandler.cpp | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp index 124d27b..a050baf 100644 --- a/src/gui/image/qgifhandler.cpp +++ b/src/gui/image/qgifhandler.cpp @@ -505,17 +505,26 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, code=oldcode; } while (code>=clear_code+2) { + if (code >= max_code) { + state = Error; + return -1; + } *sp++=table[1][code]; if (code==table[0][code]) { state=Error; - break; + return -1; } if (sp-stack>=(1<<(max_lzw_bits))*2) { state=Error; - break; + return -1; } code=table[0][code]; } + if (code < 0) { + state = Error; + return -1; + } + *sp++=firstcode=table[1][code]; code=max_code; if (code<(1<<max_lzw_bits)) { |