mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-01 13:54:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-5.5' into PHP-5.6

Browse Source 
* PHP-5.5:
  NEWS
  Fix bug #68601 buffer read overflow in gd_gif_in.c
This commit is contained in:
Remi Collet 2014-12-13 09:05:33 +01:00
commit 8bd67ce748
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
ext/gd/libgd/gd_gif_in.c
View File

@ -72,8 +72,10 @@ static struct {
#define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)
#define CSD_BUF_SIZE 280
typedef struct {
unsigned char buf[280];
unsigned char buf[CSD_BUF_SIZE];
int curbit, lastbit, done, last_byte;
} CODE_STATIC_DATA;
@ -400,7 +402,12 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
ret = 0;
for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
ret |= ((scd->buf[ i / 8 ] & (1 << (i % 8))) != 0) << j;
if (i < CSD_BUF_SIZE * 8) {
ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
} else {
ret = -1;
break;
}
scd->curbit += code_size;
return ret;