X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=deanimate.c;h=2ad811ccc3cae399d0d2e5eacef1a046df8d1457;hp=8d0e6878cf9f51c8cc704c4336b215a2fc88aca0;hb=cd275efe90ca39d461537daf389e79a3cd79e507;hpb=36f5fa200c2685ff053539184c83f1d909f0da05

diff --git a/deanimate.c b/deanimate.c
index 8d0e6878..2ad811cc 100644
--- a/deanimate.c
+++ b/deanimate.c
@@ -1,4 +1,4 @@
-const char deanimate_rcs[] = "$Id: deanimate.c,v 1.17 2007/08/05 13:42:22 fabiankeil Exp $";
+const char deanimate_rcs[] = "$Id: deanimate.c,v 1.18 2008/03/28 15:13:38 fabiankeil Exp $";
 /*********************************************************************
  *
  * File        :  $Source: /cvsroot/ijbswa/current/deanimate.c,v $
@@ -39,6 +39,9 @@ const char deanimate_rcs[] = "$Id: deanimate.c,v 1.17 2007/08/05 13:42:22 fabian
  *
  * Revisions   :
  *    $Log: deanimate.c,v $
+ *    Revision 1.18  2008/03/28 15:13:38  fabiankeil
+ *    Remove inspect-jpegs action.
+ *
  *    Revision 1.17  2007/08/05 13:42:22  fabiankeil
  *    #1763173 from Stefan Huehner: declare some more functions static.
  *
@@ -332,7 +335,14 @@ static int gif_extract_image(struct binbuffer *src, struct binbuffer *dst)
     */
    if (c & 0x80)
    {
-      if (buf_copy(src, dst, (size_t) 3 * (1 << ((c & 0x07) + 1))))
+      int map_length = 3 * (1 << ((c & 0x07) + 1));
+      if (map_length <= 0)
+      {
+         log_error(LOG_LEVEL_DEANIMATE,
+            "colormap length = %d (%c)?", map_length, c);
+         return 1;
+      }
+      if (buf_copy(src, dst, (size_t)map_length))
       {
          return 1;
       }           
@@ -411,7 +421,14 @@ int gif_deanimate(struct binbuffer *src, struct binbuffer *dst, int get_first_im
     */
    if(c & 0x80)
    {
-      if (buf_copy(src, dst, (size_t) 3 * (1 << ((c & 0x07) + 1))))
+      int map_length = 3 * (1 << ((c & 0x07) + 1));
+      if (map_length <= 0)
+      {
+         log_error(LOG_LEVEL_DEANIMATE,
+            "colormap length = %d (%c)?", map_length, c);
+         return 1;
+      }
+      if (buf_copy(src, dst, (size_t)map_length))
       {
          return 1;
       }