gif: Don't get into infinite loops on truncated files.
authorRyan C. Gordon <icculus@icculus.org>
Wed, 26 Sep 2018 15:19:17 -0400
changeset 58619beb4a1bb54
parent 585 170d7d32e4a8
child 587 32a18ca05935
gif: Don't get into infinite loops on truncated files.
IMG_gif.c
     1.1 --- a/IMG_gif.c	Wed Sep 26 14:58:31 2018 -0400
     1.2 +++ b/IMG_gif.c	Wed Sep 26 15:19:17 2018 -0400
     1.3 @@ -317,7 +317,7 @@
     1.4      break;
     1.5      case 0xfe:          /* Comment Extension */
     1.6      str = "Comment Extension";
     1.7 -    while (GetDataBlock(src, (unsigned char *) buf) != 0)
     1.8 +    while (GetDataBlock(src, (unsigned char *) buf) > 0)
     1.9          ;
    1.10      return FALSE;
    1.11      case 0xf9:          /* Graphic Control Extension */
    1.12 @@ -329,7 +329,7 @@
    1.13      if ((buf[0] & 0x1) != 0)
    1.14          Gif89.transparent = buf[3];
    1.15  
    1.16 -    while (GetDataBlock(src, (unsigned char *) buf) != 0)
    1.17 +    while (GetDataBlock(src, (unsigned char *) buf) > 0)
    1.18          ;
    1.19      return FALSE;
    1.20      default:
    1.21 @@ -338,7 +338,7 @@
    1.22      break;
    1.23      }
    1.24  
    1.25 -    while (GetDataBlock(src, (unsigned char *) buf) != 0)
    1.26 +    while (GetDataBlock(src, (unsigned char *) buf) > 0)
    1.27      ;
    1.28  
    1.29      return FALSE;
    1.30 @@ -387,7 +387,7 @@
    1.31      buf[0] = buf[last_byte - 2];
    1.32      buf[1] = buf[last_byte - 1];
    1.33  
    1.34 -    if ((count = GetDataBlock(src, &buf[2])) == 0)
    1.35 +    if ((count = GetDataBlock(src, &buf[2])) <= 0)
    1.36          done = TRUE;
    1.37  
    1.38      last_byte = 2 + count;