1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
diff -Naurp a/src/giffunc.c b/src/giffunc.c
--- a/src/giffunc.c 2021-09-20 13:19:00.000000000 +0200
+++ b/src/giffunc.c 2024-02-04 14:05:47.811880522 +0100
@@ -466,8 +466,10 @@ Gif_CopyImage(Gif_Image *src)
void Gif_MakeImageEmpty(Gif_Image* gfi) {
Gif_ReleaseUncompressedImage(gfi);
Gif_ReleaseCompressedImage(gfi);
- gfi->left = gfi->top = 0;
- gfi->width = gfi->height = 1;
+ gfi->left = gfi->left < 0xFFFE ? gfi->left : 0xFFFE;
+ gfi->top = gfi->top < 0xFFFE ? gfi->top : 0xFFFE;
+ gfi->width = 1;
+ gfi->height = 1;
gfi->transparent = 0;
Gif_CreateUncompressedImage(gfi, 0);
gfi->img[0][0] = 0;
diff -Naurp a/src/support.c b/src/support.c
--- a/src/support.c 2023-06-14 17:47:12.000000000 +0200
+++ b/src/support.c 2024-02-04 14:05:51.307885109 +0100
@@ -1421,9 +1421,9 @@ analyze_crop(int nmerger, Gt_Crop* crop,
}
}
- if (t > b)
+ if (t > b) {
crop->w = crop->h = 0;
- else {
+ } else {
crop->x = l;
crop->y = t;
crop->w = r - l;
@@ -1618,7 +1618,8 @@ merge_frame_interval(Gt_Frameset *fset,
desti->comment = 0;
}
if (fr->comment) {
- if (!desti->comment) desti->comment = Gif_NewComment();
+ if (!desti->comment)
+ desti->comment = Gif_NewComment();
merge_comments(desti->comment, fr->comment);
/* delete the comment early to help with memory; set field to 0 so we
don't re-free it later */
@@ -1628,10 +1629,22 @@ merge_frame_interval(Gt_Frameset *fset,
if (fr->interlacing >= 0)
desti->interlace = fr->interlacing;
- if (fr->left >= 0)
- desti->left = fr->left + (fr->position_is_offset ? desti->left : 0);
- if (fr->top >= 0)
- desti->top = fr->top + (fr->position_is_offset ? desti->top : 0);
+ if (fr->left >= 0) {
+ int left = fr->left + (fr->position_is_offset ? desti->left : 0);
+ if (left + desti->width > 65535) {
+ error(1, "left position %d out of range", left);
+ return 0;
+ }
+ desti->left = left;
+ }
+ if (fr->top >= 0) {
+ int top = fr->top + (fr->position_is_offset ? desti->top : 0);
+ if (top + desti->height > 65535) {
+ error(1, "top position %d out of range", top);
+ return 0;
+ }
+ desti->top = top;
+ }
if (fr->delay >= 0)
desti->delay = fr->delay;
diff -Naurp a/src/xform.c b/src/xform.c
--- a/src/xform.c 2023-06-14 17:48:05.000000000 +0200
+++ b/src/xform.c 2024-02-04 14:05:47.812880524 +0100
@@ -262,18 +262,18 @@ crop_image(Gif_Image* gfi, Gt_Frame* fr,
gfi->img[j] = old_img[c.y + j] + c.x;
gfi->img[c.h] = 0;
Gif_DeleteArray(old_img);
+ gfi->left += c.x - fr->left_offset;
+ gfi->top += c.y - fr->top_offset;
gfi->width = c.w;
gfi->height = c.h;
- } else if (preserve_total_crop)
+ } else if (preserve_total_crop) {
Gif_MakeImageEmpty(gfi);
- else {
+ } else {
Gif_DeleteArray(gfi->img);
gfi->img = 0;
gfi->width = gfi->height = 0;
}
- gfi->left += c.x - fr->left_offset;
- gfi->top += c.y - fr->top_offset;
return gfi->img != 0;
}
|
GitWeb