nsxiv470f50f
fix: img_load_gif: out-of-bound access
according to imlib2's gif loader, bg should already be transparent black if bg > cmap->ColorCount
+7 −4
1 file changed
- M image.c +7 −4
| @@ -203,10 +203,13 @@ static bool img_load_gif(img_t *img, const fileinfo_t *file) | |||
| 203 | 203 | ||
| 204 | 204 | ptr = data = emalloc(sw * sh * sizeof(DATA32)); | |
| 205 | 205 | cmap = gif->Image.ColorMap ? gif->Image.ColorMap : gif->SColorMap; | |
| 206 | − | r = cmap->Colors[bg].Red; | |
| 207 | − | g = cmap->Colors[bg].Green; | |
| 208 | − | b = cmap->Colors[bg].Blue; | |
| 209 | − | bgpixel = 0x00ffffff & (r << 16 | g << 8 | b); | |
| 206 | + | /* if bg > cmap->ColorCount, it is transparent black already */ | |
| 207 | + | if (cmap && bg >= 0 && bg < cmap->ColorCount) { | |
| 208 | + | r = cmap->Colors[bg].Red; | |
| 209 | + | g = cmap->Colors[bg].Green; | |
| 210 | + | b = cmap->Colors[bg].Blue; | |
| 211 | + | bgpixel = 0x00ffffff & (r << 16 | g << 8 | b); | |
| 212 | + | } | |
| 210 | 213 | ||
| 211 | 214 | for (i = 0; i < sh; i++) { | |
| 212 | 215 | for (j = 0; j < sw; j++) { | |