diff --git a/tools/gif2tiff.c b/tools/gif2tiff.c index 2731273..ca824e2 100644 --- a/tools/gif2tiff.c +++ b/tools/gif2tiff.c @@ -280,6 +280,10 @@ readgifimage(char* mode) fprintf(stderr, "no colormap present for image\n"); return (0); } + if (width == 0 || height == 0) { + fprintf(stderr, "Invalid value of width or height\n"); + return(0); + } if ((raster = (unsigned char*) _TIFFmalloc(width*height+EXTRAFUDGE)) == NULL) { fprintf(stderr, "not enough memory for image\n"); return (0); @@ -406,7 +410,11 @@ process(register int code, unsigned char** fill) fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear); return 0; } - *(*fill)++ = suffix[code]; + if (*fill >= raster + width*height) { + fprintf(stderr, "raster full before eoi code\n"); + return 0; + } + *(*fill)++ = suffix[code]; firstchar = oldcode = code; return 1; } @@ -436,7 +444,11 @@ process(register int code, unsigned char** fill) } oldcode = incode; do { - *(*fill)++ = *--stackp; + if (*fill >= raster + width*height) { + fprintf(stderr, "raster full before eoi code\n"); + return 0; + } + *(*fill)++ = *--stackp; } while (stackp > stack); return 1; }