* image.c (gif_load): Check that subimages fit.

Fixes: debbugs:14345

diff --git a/src/ChangeLog b/src/ChangeLog
index f66858249331bbaf8d435b1374085c6cf1f80b8b..836f6d4b7b808ae03c6311d895931151688fa116 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2013-05-12  Paul Eggert  <eggert@cs.ucla.edu>
+
+       * image.c (gif_load): Check that subimages fit (Bug#14345).
+
 2013-05-09  Stefan Monnier  <monnier@iro.umontreal.ca>
 
        * lread.c (skip_dyn_eof): New function.

diff --git a/src/image.c b/src/image.c
index 2dae63a294f0f92a1a6beec47787563b973b4f8f..f9f6ce7004024ee54a700092ed8282ac72ad8056 100644 (file)
--- a/src/image.c
+++ b/src/image.c
@@ -7263,6 +7263,25 @@ gif_load (struct frame *f, struct image *img)
       return 0;
     }
 
+  /* Check that the selected subimages fit.  It's not clear whether
+     the GIF spec requires this, but Emacs can crash if they don't fit.  */
+  for (j = 0; j <= idx; ++j)
+    {
+      struct SavedImage *subimage = gif->SavedImages + j;
+      int subimg_width = subimage->ImageDesc.Width;
+      int subimg_height = subimage->ImageDesc.Height;
+      int subimg_top = subimage->ImageDesc.Top;
+      int subimg_left = subimage->ImageDesc.Left;
+      if (! (0 <= subimg_width && 0 <= subimg_height
+            && 0 <= subimg_top && subimg_top <= height - subimg_height
+            && 0 <= subimg_left && subimg_left <= width - subimg_width))
+       {
+         image_error ("Subimage does not fit in image", Qnil, Qnil);
+         fn_DGifCloseFile (gif);
+         return 0;
+       }
+    }
+
   /* Create the X image and pixmap.  */
   if (!x_create_x_image_and_pixmap (f, width, height, 0, &ximg, &img->pixmap))
     {