Fix [fbaed1f66b]: [image create photo] errors out on a sane animated gif. Cherrypicked [95f4a8e283]

3 files changed, 31 insertions, 25 deletions

diff --git a/generic/tkImgGIF.c b/generic/tkImgGIF.c
index 409300c..e7f4582 100644
--- a/generic/tkImgGIF.c
+++ b/generic/tkImgGIF.c
@@ -963,9 +963,9 @@ ReadImage(
 		     * Last pass reset the decoder, so the first code we see
 		     * must be a singleton. Seed the stack with it, and set up
 		     * the old/first code pointers for insertion into the
-		     * string table. We can't just roll this into the
-		     * clearCode test above, because at that point we have not
-		     * yet read the next code.
+		     * codes table. We can't just roll this into the clearCode
+		     * test above, because at that point we have not yet read
+		     * the next code.
 		     */
 
 		    *top++ = append[code];
@@ -976,11 +976,11 @@ ReadImage(
 
 		inCode = code;
 
-		if (code == maxCode) {
+		if ((code == maxCode) && (maxCode < (1 << MAX_LWZ_BITS))) {
 		    /*
 		     * maxCode is always one bigger than our highest assigned
 		     * code. If the code we see is equal to maxCode, then we
-		     * are about to add a new string to the table. ???
+		     * are about to add a new entry to the codes table.
 		     */
 
 		    *top++ = firstCode;
@@ -989,7 +989,7 @@ ReadImage(
 
 		while (code > clearCode) {
 		    /*
-		     * Populate the stack by tracing the string in the string
+		     * Populate the stack by tracing the code in the codes
 		     * table from its tail to its head
 		     */
 
@@ -998,28 +998,24 @@ ReadImage(
 		}
 		firstCode = append[code];
 
-		/*
-		 * If there's no more room in our string table, quit.
-		 * Otherwise, add a new string to the table
-		 */
-
-		if (maxCode >= (1 << MAX_LWZ_BITS)) {
-		    return TCL_OK;
-		}
-
-		/*
-		 * Push the head of the string onto the stack.
-		 */
+	        /*
+	         * Push the head of the code onto the stack.
+	         */
 
-		*top++ = firstCode;
+	        *top++ = firstCode;
 
-		/*
-		 * Add a new string to the string table
-		 */
+                if (maxCode < (1 << MAX_LWZ_BITS)) {
+		    /*
+		     * If there's still room in our codes table, add a new entry.
+		     * Otherwise don't, and keep using the current table.
+                     * See DEFERRED CLEAR CODE IN LZW COMPRESSION in the GIF89a
+                     * specification.
+		     */
 
-		prefix[maxCode] = oldCode;
-		append[maxCode] = firstCode;
-		maxCode++;
+		    prefix[maxCode] = oldCode;
+		    append[maxCode] = firstCode;
+		    maxCode++;
+                }
 
 		/*
 		 * maxCode tells us the maximum code value we can accept. If
diff --git a/tests/deferredClearCode.gif b/tests/deferredClearCode.gif
new file mode 100644
index 0000000..d530618
--- /dev/null
+++ b/tests/deferredClearCode.gif
diff --git a/tests/imgPhoto.test b/tests/imgPhoto.test
index cf25d6a..2b5f7ec 100644
--- a/tests/imgPhoto.test
+++ b/tests/imgPhoto.test
@@ -716,6 +716,16 @@ test imgPhoto-14.4 {GIF buffer overflow} -setup {
 } -cleanup {
     image delete $i
 } -returnCodes error -result {malformed image}
+test imgPhoto-14.5 {Bug [fbaed1f66b] - GIF decoder with deferred clear code} -setup {
+    set fileName [file join [file dirname [info script]] deferredClearCode.gif]
+} -body {
+    # This erroneously produced "malformed image" error.
+    # The animated GIF "deferredClearCode.gif" has two frames, and calling for -index 2
+    # simply is an easy way to trigger the problem of improper management of a deferred
+    # clear code. The effect was that the GIF decoder bailed out before the end of the
+    # image reading, and produced the inappropriate "malformed image error".
+    image create photo -file $fileName -format "gif -index 2"
+} -returnCodes error -result {no image data for this index}
 
 test imgPhoto-15.1 {photo images can fail to allocate memory gracefully} \
 	{nonPortable} {