From fa24cfa09d64817ed42618ad77eabf3478225697 Mon Sep 17 00:00:00 2001
From: Michael Wetherell <mike.wetherell@ntlworld.com>
Date: Tue, 31 Oct 2006 09:35:57 +0000
Subject: [PATCH] Fix for handling of invalid gifs, patch 1587754 Noel Byron.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@42824 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---
 src/common/gifdecod.cpp | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/src/common/gifdecod.cpp b/src/common/gifdecod.cpp
index a96e64b18d..e520174b4d 100644
--- a/src/common/gifdecod.cpp
+++ b/src/common/gifdecod.cpp
@@ -715,12 +715,12 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
             {
                 while ((i = (unsigned char)stream.GetC()) != 0)
                 {
-                    stream.SeekI(i, wxFromCurrent);
-                    if (stream.Eof())
+                    if (stream.Eof() || (stream.LastRead() == 0))
                     {
                         done = true;
                         break;
                     }
+                    stream.SeekI(i, wxFromCurrent);
                 }
             }
         }
@@ -846,6 +846,11 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
             /* skip all data */
             while ((i = (unsigned char)stream.GetC()) != 0)
             {
+                if (stream.Eof() || (stream.LastRead() == 0))
+                {
+                    Destroy();
+                    return wxGIF_INVFORMAT;
+                }
                 stream.SeekI(i, wxFromCurrent);
             }
         }
@@ -867,19 +872,24 @@ wxGIFErrorCode wxGIFDecoder::LoadGIF(wxInputStream& stream)
                 wxFileOffset pos = stream.TellI();
                 wxFileOffset numBytes = 3 * local_ncolors;
                 stream.SeekI(numBytes, wxFromCurrent);
-                if (stream.TellI() != (pos + numBytes))
-                {
-                    Destroy();
-                    return wxGIF_INVFORMAT;
-                }
             }
 
             /* initial code size */
             (void) stream.GetC();
+            if (stream.Eof() || (stream.LastRead() == 0))
+            {
+                Destroy();
+                return wxGIF_INVFORMAT;
+            }
 
             /* skip all data */
             while ((i = (unsigned char)stream.GetC()) != 0)
             {
+                if (stream.Eof() || (stream.LastRead() == 0))
+                {
+                    Destroy();
+                    return wxGIF_INVFORMAT;
+                }
                 stream.SeekI(i, wxFromCurrent);
             }
         }