summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Drake <tlsa@netsurf-browser.org>2021-04-22 22:28:52 +0100
committerMichael Drake <tlsa@netsurf-browser.org>2021-04-22 22:30:35 +0100
commitf9b8f113aa8a51ef4a704c129a7e939800efdbc5 (patch)
tree73e2bac01aaf722311a3d7d6ca278b56d2e11372
parent0aeb0afe342d035ab32bac1d89b185f25d7acf32 (diff)
downloadlibnsgif-f9b8f113aa8a51ef4a704c129a7e939800efdbc5.tar.gz
libnsgif-f9b8f113aa8a51ef4a704c129a7e939800efdbc5.tar.bz2
lzw: Detect invalid code after clear code.
-rw-r--r--src/lzw.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/src/lzw.c b/src/lzw.c
index 4b521b6..dd30d01 100644
--- a/src/lzw.c
+++ b/src/lzw.c
@@ -347,8 +347,12 @@ static inline lzw_result lzw__decode(struct lzw_ctx *ctx,
} else if (code == ctx->clear_code) {
lzw__clear_table(ctx);
} else {
- if (ctx->prev_code != ctx->clear_code &&
- ctx->table_size < LZW_TABLE_ENTRY_MAX) {
+ if (ctx->prev_code == ctx->clear_code) {
+ if (code > ctx->clear_code) {
+ return LZW_BAD_ICODE;
+ }
+
+ } else if (ctx->table_size < LZW_TABLE_ENTRY_MAX) {
uint32_t size = ctx->table_size;
lzw__table_add_entry(ctx, (code < size) ?
ctx->table[code].first :