diff options
| author | Nicolas Pena <npm@chromium.org> | 2017-05-01 11:26:41 -0400 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-05-01 16:20:03 +0000 |
| commit | b8e00f24780335cdd068565f39d2874c81e799b9 (patch) | |
| tree | 23977688994e3fb91ce6c68acb1c52e4d250fcc9 | |
| parent | 72b715d51383eecf98aad590bfe9fcd04de1fbf2 (diff) | |
| download | pdfium-b8e00f24780335cdd068565f39d2874c81e799b9.tar.xz | |
Fix CGifLZWDecoder::Decode comparison
Only use code_end to finish the decoding. Remove ASSERT from DecodeString since
it may be triggered. The following if statement handles that case anyways.
Bug: pdfium:707
Change-Id: Id6ec3c66d0e43c46308b4c3416da6c482ceafc69
Reviewed-on: https://pdfium-review.googlesource.com/4670
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>
| -rw-r--r-- | core/fxcodec/lgif/fx_gif.cpp | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/core/fxcodec/lgif/fx_gif.cpp b/core/fxcodec/lgif/fx_gif.cpp index 3d5d0e2325..8c9955f702 100644 --- a/core/fxcodec/lgif/fx_gif.cpp +++ b/core/fxcodec/lgif/fx_gif.cpp @@ -61,10 +61,9 @@ void CGifLZWDecoder::ClearTable() { void CGifLZWDecoder::DecodeString(uint16_t code) { stack_size = 0; while (true) { - ASSERT(code <= code_next); - if (code < code_clear || code > code_next) { + if (code < code_clear || code > code_next) break; - } + stack[GIF_MAX_LZW_CODE - 1 - stack_size++] = code_table[code].suffix; code = code_table[code].prefix; } @@ -135,7 +134,7 @@ int32_t CGifLZWDecoder::Decode(uint8_t* des_buf, uint32_t& des_size) { if (code == code_clear) { ClearTable(); continue; - } else if (code >= code_end) { + } else if (code == code_end) { des_size = i; return 1; } else { |