gif: report error on bogus LWZ data, instead of overflowing a buffer.

icculus · icculus · commit 4c830d486246 · 2018-01-27T23:28:09.000-05:00
diff --git a/IMG_gif.c b/IMG_gif.c
@@ -497,8 +497,10 @@ LWZReadByte(SDL_RWops *src, int flag, int input_code_size)
             return -3;
         }
         *sp++ = table[1][code];
-        if (code == table[0][code])
-        RWSetMsg("circular table entry BIG ERROR");
+        if (code == table[0][code]) {
+            RWSetMsg("circular table entry BIG ERROR");
+            return -3;
+        }
         code = table[0][code];
     }
 

Original file line number	Diff line number	Diff line change
`@@ -497,8 +497,10 @@ LWZReadByte(SDL_RWops *src, int flag, int input_code_size)`
`497`	`497`	`return -3;`
`498`	`498`	`}`
`499`	`499`	`*sp++ = table[1][code];`
`500`		`- if (code == table[0][code])`
`501`		`- RWSetMsg("circular table entry BIG ERROR");`
	`500`	`+ if (code == table[0][code]) {`
	`501`	`+ RWSetMsg("circular table entry BIG ERROR");`
	`502`	`+ return -3;`
	`503`	`+ }`
`502`	`504`	`code = table[0][code];`
`503`	`505`	`}`
`504`	`506`