- #38112, corrupt GIF segfaults, test will follow

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 78c454589eba59c1ee6c88b37b9cb0a9579ce8cd..b4bc7752d0e9691d42cdcca820fe3b57f0961229 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -206,6 +206,7 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
                                        BitSet(buf[8], INTERLACE));
                        /*1.4//imageCount != imageNumber); */
                }
+
                if (Transparent != (-1)) {
                        gdImageColorTransparent(im, Transparent);
                }
@@ -217,6 +218,12 @@ terminated:
        if (!im) {
                return 0;
        }
+
+       if (!im->colorsTotal) {
+               gdImageDestroy(im);
+               return 0;
+       }
+
        /* Check for open colors at the end, so
           we can reduce colorsTotal and ultimately
           BitsPerPixel */
@@ -506,6 +513,19 @@ static void ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned
        int             v;
        int             xpos = 0, ypos = 0, pass = 0;
        int i;
+
+
+       /*
+        **  Initialize the Compression routines
+        */
+       if (! ReadOK(fd,&c,1)) {
+               return;
+       }
+
+       if (c > 8) {
+               return; 
+       }
+
        /* Stash the color map into the image */
        for (i=0; (i<gdMaxColors); i++) {
                im->red[i] = cmap[CM_RED][i];
@@ -515,12 +535,6 @@ static void ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned
        }
        /* Many (perhaps most) of these colors will remain marked open. */
        im->colorsTotal = gdMaxColors;
-       /*
-        **  Initialize the Compression routines
-        */
-       if (! ReadOK(fd,&c,1)) {
-               return;
-       }
        if (LWZReadByte(fd, TRUE, c) < 0) {
                return;
        }