also change it to a loop
Fixes out of array access
Fixes: asan_heap-oob_ca5410_8_asan_heap-oob_ca5410_97_ID_LSD_Size_Less_Then_Data_Inter_3.gif
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8f1457864be8fb9653643519dea1c6492f1dde57)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -125,26 +125,21 @@ static int gif_read_image(GifState *s) |
125 | 125 |
case 1: |
126 | 126 |
y1 += 8; |
127 | 127 |
ptr += linesize * 8; |
128 |
- if (y1 >= height) { |
|
129 |
- y1 = pass ? 2 : 4; |
|
130 |
- ptr = ptr1 + linesize * y1; |
|
131 |
- pass++; |
|
132 |
- } |
|
133 | 128 |
break; |
134 | 129 |
case 2: |
135 | 130 |
y1 += 4; |
136 | 131 |
ptr += linesize * 4; |
137 |
- if (y1 >= height) { |
|
138 |
- y1 = 1; |
|
139 |
- ptr = ptr1 + linesize; |
|
140 |
- pass++; |
|
141 |
- } |
|
142 | 132 |
break; |
143 | 133 |
case 3: |
144 | 134 |
y1 += 2; |
145 | 135 |
ptr += linesize * 2; |
146 | 136 |
break; |
147 | 137 |
} |
138 |
+ while (y1 >= height) { |
|
139 |
+ y1 = 4 >> pass; |
|
140 |
+ ptr = ptr1 + linesize * y1; |
|
141 |
+ pass++; |
|
142 |
+ } |
|
148 | 143 |
} else { |
149 | 144 |
ptr += linesize; |
150 | 145 |
} |