- MFB: #41630, fix segfault when an invalid color index is present in the

  image data

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 7076518c72d4e44e60b734b6add33d965a2794c1..21409c5733a527b5da97ab564dab30b72775d0f2 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -590,6 +590,10 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        /*} */
 
        while ((v = LWZReadByte(fd, &sd, FALSE, c, ZeroDataBlockP)) >= 0 ) {
+               if (v >= gdMaxColors) {
+                       v = 0;
+               }
+
                /* This how we recognize which colors are actually used. */
                if (im->open[v]) {
                        im->open[v] = 0;