/* LZW compatible decoder */
uint8_t *bytestream;
+ uint8_t *bytestream_end;
LZWState *lzw;
/* aux buffers */
int v, n;
int has_global_palette;
+ if (s->bytestream_end < s->bytestream + 13)
+ return -1;
+
/* read gif signature */
bytestream_get_buffer(&s->bytestream, sig, 6);
if (memcmp(sig, gif87a_sig, 6) != 0 &&
#endif
if (has_global_palette) {
n = 1 << s->bits_per_pixel;
+ if (s->bytestream_end < s->bytestream + n * 3)
+ return -1;
bytestream_get_buffer(&s->bytestream, s->global_palette, n * 3);
}
return 0;
static int gif_parse_next_image(GifState *s)
{
- for (;;) {
+ while (s->bytestream < s->bytestream_end) {
int code = bytestream_get_byte(&s->bytestream);
#ifdef DEBUG
dprintf(s->avctx, "gif: code=%02x '%c'\n", code, code);
int ret;
s->bytestream = buf;
+ s->bytestream_end = buf + buf_size;
if (gif_read_header1(s) < 0)
return -1;