- #41630, fix segfault when an invalid color index is present in the image

  data

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 8ee77b02e88847e86323c53529f64762fc23a8e5..ee88a2fc8e102720526f9b37ec17c46f4a383484 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -586,7 +586,10 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        /*        return; */
        /*} */
 
-       while ((v = LWZReadByte(fd, &sd, FALSE, c, ZeroDataBlockP)) >= 0 ) {
+       while ((v = LWZReadByte(fd, &sd, FALSE, c, ZeroDataBlockP)) >= 0) {
+               if (v >= gdMaxColors) {
+                       v = 0;
+               }
                /* This how we recognize which colors are actually used. */
                if (im->open[v]) {
                        im->open[v] = 0;