summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
Diffstat (limited to 'core')
-rw-r--r--core/fxcodec/lgif/fx_gif.cpp12
1 files changed, 11 insertions, 1 deletions
diff --git a/core/fxcodec/lgif/fx_gif.cpp b/core/fxcodec/lgif/fx_gif.cpp
index 93db181a98..d62dacb36c 100644
--- a/core/fxcodec/lgif/fx_gif.cpp
+++ b/core/fxcodec/lgif/fx_gif.cpp
@@ -114,7 +114,17 @@ int32_t CGifLZWDecoder::Decode(uint8_t* des_buf, uint32_t& des_size) {
FXSYS_strncpy(err_msg_ptr, "Decode Error", GIF_MAX_ERROR_SIZE - 1);
return 0;
}
- code_store |= (*next_in++) << bits_left;
+ pdfium::base::CheckedNumeric<uint32_t> safe_code = *next_in++;
+ safe_code <<= bits_left;
+ safe_code |= code_store;
+ if (!safe_code.IsValid()) {
+ if (err_msg_ptr) {
+ FXSYS_strncpy(err_msg_ptr, "Code Store Out Of Range",
+ GIF_MAX_ERROR_SIZE - 1);
+ }
+ return 0;
+ }
+ code_store = safe_code.ValueOrDie();
avail_in--;
bits_left += 8;
}