From 7876609b3540137663d48282ad94ba42a3749e73 Mon Sep 17 00:00:00 2001 From: Nicolas Pena Date: Tue, 16 May 2017 18:30:24 -0400 Subject: Gif: Detect string decoding errors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This CL adds some checks to make sure the DecodeString method does not go out out control: If code is equal to code_table[code].prefix, it will try to loop forever. Even if that's not the case, avoid reading a negative position from the stack. Bug: chromium:722672 Change-Id: I638f91542ba21f3a9915198fef853cc3cf94f4f1 Reviewed-on: https://pdfium-review.googlesource.com/5513 Reviewed-by: Tom Sepez Commit-Queue: Nicolás Peña --- core/fxcodec/lgif/fx_gif.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'core/fxcodec/lgif/fx_gif.h') diff --git a/core/fxcodec/lgif/fx_gif.h b/core/fxcodec/lgif/fx_gif.h index 5df1f817ef..d7cd5d83fb 100644 --- a/core/fxcodec/lgif/fx_gif.h +++ b/core/fxcodec/lgif/fx_gif.h @@ -142,7 +142,7 @@ class CGifLZWDecoder { private: void ClearTable(); void AddCode(uint16_t prefix_code, uint8_t append_char); - void DecodeString(uint16_t code); + bool DecodeString(uint16_t code); uint8_t code_size; uint8_t code_size_cur; -- cgit v1.2.3