Commit aeb0ad3
committed
Fix out-of-bounds read access in GIF decoding
Caught by lldb:
* thread #1, stop reason = EXC_BAD_ACCESS (code=1, address=0x1080d6000)
frame #0: 0x00000001000061a4 demo-sdl`_twin_gif_to_pixmap [inlined] gif_is_bgcolor(gif=0x00000001008b4200, color=<unavailable>) at image-gif.c:516:13 [opt]
513
514 static int gif_is_bgcolor(const twin_gif_t *gif, const uint8_t *color)
515 {
-> 516 return !memcmp(&gif->palette->colors[gif->bgindex * 3], color, 3);
517 }
518
519 static void gif_rewind(twin_gif_t *gif)
Target 0: (demo-sdl) stopped.
(lldb) up
frame #1: 0x000000010000619e demo-sdl`_twin_gif_to_pixmap at image-gif.c:584 [opt]
581 uint8_t r = *(color++);
582 uint8_t g = *(color++);
583 uint8_t b = *(color++);
-> 584 if (!gif_is_bgcolor(gif, color))
585 *(p.argb32++) = 0xFF000000U | (r << 16) | (g << 8) | b;
586 /* Construct background */
587 else if (((row >> 3) + (col >> 3)) & 1)
The removal of unnecessary pointer arithmetics also help compiler
optimizations.1 parent ef29046 commit aeb0ad3
2 files changed
+4
-4
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
117 | 117 | | |
118 | 118 | | |
119 | 119 | | |
120 | | - | |
| 120 | + | |
121 | 121 | | |
122 | 122 | | |
123 | 123 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
578 | 578 | | |
579 | 579 | | |
580 | 580 | | |
581 | | - | |
582 | | - | |
583 | | - | |
| 581 | + | |
584 | 582 | | |
585 | 583 | | |
586 | 584 | | |
| |||
593 | 591 | | |
594 | 592 | | |
595 | 593 | | |
| 594 | + | |
| 595 | + | |
596 | 596 | | |
597 | 597 | | |
598 | 598 | | |
| |||
0 commit comments