https://github.com/ImageMagick/ImageMagick/issues/831

diff --git a/coders/gif.c b/coders/gif.c
index f68e31002d898c8b827d8243d007d60aae59489a..8b19da3e240ab0e68968ed6411afe9499cdf6f53 100644 (file)
--- a/coders/gif.c
+++ b/coders/gif.c
@@ -970,6 +970,7 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
     global_colors,
     image_count,
     iterations,
+    local_colors,
     one;
 
   ssize_t
@@ -1260,8 +1261,9 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
     image->depth=8;
     flag=(unsigned char) ReadBlobByte(image);
     image->interlace=BitSet((int) flag,0x40) != 0 ? GIFInterlace : NoInterlace;
-    image->colors=BitSet((int) flag,0x80) == 0 ? global_colors : one <<
+    local_colors=BitSet((int) flag,0x80) == 0 ? global_colors : one <<
       ((size_t) (flag & 0x07)+1);
+    image->colors=local_colors;
     if (opacity >= (ssize_t) image->colors)
       image->colors=opacity+1;
     image->page.width=page.width;
@@ -1320,8 +1322,8 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
         /*
           Read local colormap.
         */
-        colormap=(unsigned char *) AcquireQuantumMemory(image->colors,3*
-          sizeof(*colormap));
+        colormap=(unsigned char *) AcquireQuantumMemory((size_t)
+          MagickMax(local_colors,256),3UL*sizeof(*colormap));
         if (colormap == (unsigned char *) NULL)
           {
             global_colormap=(unsigned char *) RelinquishMagickMemory(
@@ -1329,8 +1331,10 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
             meta_image=DestroyImage(meta_image);
             ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
           }
-        count=ReadBlob(image,(3*image->colors)*sizeof(*colormap),colormap);
-        if (count != (ssize_t) (3*image->colors))
+        (void) ResetMagickMemory(colormap,0,3*MagickMax(local_colors,256)*
+          sizeof(*colormap));
+        count=ReadBlob(image,(3*local_colors)*sizeof(*colormap),colormap);
+        if (count != (ssize_t) (3*local_colors))
           {
             global_colormap=(unsigned char *) RelinquishMagickMemory(
               global_colormap);
@@ -1355,7 +1359,7 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
         for (i=0; i < (ssize_t) image->colors; i++)
           if (IsPixelInfoGray(image->colormap+i) == MagickFalse)
             break;
-        (void) SetImageColorspace(image,i == (ssize_t) image->colors ? 
+        (void) SetImageColorspace(image,i == (ssize_t) image->colors ?
           GRAYColorspace : RGBColorspace,exception);
       }
     if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
@@ -1725,12 +1729,12 @@ static MagickBooleanType WriteGIFImage(const ImageInfo *image_info,Image *image,
         if ((LocaleCompare(write_info->magick,"GIF87") != 0) &&
             (value != (const char *) NULL))
           {
-            register const char 
+            register const char
               *p;
 
             size_t
               count;
-    
+
             /*
               Write comment extension.
             */