Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix out-of-bounds read access in GIF decoding
Caught by lldb: * thread #1, stop reason = EXC_BAD_ACCESS (code=1, address=0x1080d6000) frame #0: 0x00000001000061a4 demo-sdl`_twin_gif_to_pixmap [inlined] gif_is_bgcolor(gif=0x00000001008b4200, color=<unavailable>) at image-gif.c:516:13 [opt] 513 514 static int gif_is_bgcolor(const twin_gif_t *gif, const uint8_t *color) 515 { -> 516 return !memcmp(&gif->palette->colors[gif->bgindex * 3], color, 3); 517 } 518 519 static void gif_rewind(twin_gif_t *gif) Target 0: (demo-sdl) stopped. (lldb) up frame #1: 0x000000010000619e demo-sdl`_twin_gif_to_pixmap at image-gif.c:584 [opt] 581 uint8_t r = *(color++); 582 uint8_t g = *(color++); 583 uint8_t b = *(color++); -> 584 if (!gif_is_bgcolor(gif, color)) 585 *(p.argb32++) = 0xFF000000U | (r << 16) | (g << 8) | b; 586 /* Construct background */ 587 else if (((row >> 3) + (col >> 3)) & 1) The removal of unnecessary pointer arithmetics also help compiler optimizations.
- Loading branch information