dnrops
/
gimp
mirror of https://github.com/GNOME/gimp.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SGI: fix out of bounds writes 

The functions read_rle8() and read_rle16() didn't check if the addresses
to which they wrote are in bounds when expanding runlength encoded data.
This commit is contained in:
Simon Budig 2009-12-09 16:05:05 +01:00 committed by Nils Philippsen
parent 838be627be
commit 4d9724f2f6
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plug-ins/file-sgi/sgi-lib.c
View File

@ -680,7 +680,7 @@ read_rle8(sgi_t *sgip, /* I - SGI image to read from */
return (-1);
length ++;
count = ch & 127;
count = MIN (ch & 127, xsize);
if (count == 0)
break;
@ -725,7 +725,7 @@ read_rle16(sgi_t *sgip, /* I - SGI image to read from */
return (-1);
length ++;
count = ch & 127;
count = MIN (ch & 127, xsize);
if (count == 0)
break;