dallasgroot/Gimp
dallasgroot/Gimp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

file-gif-load: limit len and height (CVE-2012-3481)

Browse source 
Ensure values of len and height can't overflow g_malloc() argument type.
This commit is contained in:
Jan Lieskovsky 2012-08-14 12:18:22 +02:00 committed by Nils Philippsen
parent 86f4cd39bd
commit d95c2f0bcb
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
plug-ins/common/file-gif-load.c
View file

@ -1057,6 +1057,13 @@ ReadImage (FILE *fd,
cur_progress = 0;
max_progress = height;
if (len > (G_MAXSIZE / height / (alpha_frame ? (promote_to_rgb ? 4 : 2) : 1)))
{
g_message ("'%s' has a larger image size than GIMP can handle.",
gimp_filename_to_utf8 (filename));
return -1;
}
if (alpha_frame)
dest = (guchar *) g_malloc (len * height * (promote_to_rgb ? 4 : 2));
else