diff options
author | Michael Drake <tlsa@netsurf-browser.org> | 2021-04-22 22:28:52 +0100 |
---|---|---|
committer | Michael Drake <tlsa@netsurf-browser.org> | 2021-04-22 22:30:35 +0100 |
commit | f9b8f113aa8a51ef4a704c129a7e939800efdbc5 (patch) | |
tree | 73e2bac01aaf722311a3d7d6ca278b56d2e11372 | |
parent | 0aeb0afe342d035ab32bac1d89b185f25d7acf32 (diff) | |
download | libnsgif-f9b8f113aa8a51ef4a704c129a7e939800efdbc5.tar.gz libnsgif-f9b8f113aa8a51ef4a704c129a7e939800efdbc5.tar.bz2 |
lzw: Detect invalid code after clear code.
-rw-r--r-- | src/lzw.c | 8 |
1 files changed, 6 insertions, 2 deletions
@@ -347,8 +347,12 @@ static inline lzw_result lzw__decode(struct lzw_ctx *ctx, } else if (code == ctx->clear_code) { lzw__clear_table(ctx); } else { - if (ctx->prev_code != ctx->clear_code && - ctx->table_size < LZW_TABLE_ENTRY_MAX) { + if (ctx->prev_code == ctx->clear_code) { + if (code > ctx->clear_code) { + return LZW_BAD_ICODE; + } + + } else if (ctx->table_size < LZW_TABLE_ENTRY_MAX) { uint32_t size = ctx->table_size; lzw__table_add_entry(ctx, (code < size) ? ctx->table[code].first : |