diff options
| author | Ryan Harrison <rharrison@chromium.org> | 2017-09-22 10:53:34 -0400 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-09-22 15:03:06 +0000 |
| commit | 73bed4ef57444a2ea066d532a8a82b230fd206d9 (patch) | |
| tree | 05b9a588ea3daa1e4ef997d47c9d9a0d200019ff /core/fxcodec/lgif/cgifcontext.h | |
| parent | 0150a5455829ede62017bc24ed9c4bcdc1cafef2 (diff) | |
| download | pdfium-73bed4ef57444a2ea066d532a8a82b230fd206d9.tar.xz | |
Fix crash when rendering invalid GIF
The core fix in this CL is a change to how LWZ decompression works, so
that when the min code table size and the color palette size are
different, color codes after the end of the defined color palette are
considered errors.
This CL also introduces a bunch of tweaks to the call return path,
since there were multiple locations where the GIF decode failing
status was being dropped on the floor, so the end widget would have a
bitmap with the default colour in it, instead of nothing.
BUG=chromium:616671
Change-Id: Id6f40d552dc24650c91e9903f710ff2fa63bc774
Reviewed-on: https://pdfium-review.googlesource.com/14630
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'core/fxcodec/lgif/cgifcontext.h')
| -rw-r--r-- | core/fxcodec/lgif/cgifcontext.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/core/fxcodec/lgif/cgifcontext.h b/core/fxcodec/lgif/cgifcontext.h index d85243711d..71cf2bc75e 100644 --- a/core/fxcodec/lgif/cgifcontext.h +++ b/core/fxcodec/lgif/cgifcontext.h @@ -40,7 +40,7 @@ class CGifContext : public CCodec_GifModule::Context { UnownedPtr<CCodec_GifModule> m_pModule; UnownedPtr<CCodec_GifModule::Delegate> m_pDelegate; std::vector<GifPalette> m_GlobalPalette; - int32_t global_pal_num; + uint8_t global_pal_exp; uint32_t img_row_offset; uint32_t img_row_avail_size; uint32_t avail_in; |