...

diff --git a/coders/gif.c b/coders/gif.c
index aeef70694eff99f2d7c7fd50c057a976f0d9908c..109ef16d2062dac8f4891c061b2df45bf8cb6fd9 100644 (file)
--- a/coders/gif.c
+++ b/coders/gif.c
@@ -1085,22 +1085,28 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
               *comments;
 
             size_t
-              length;
+              extent,
+              offset;
 
-            /*
-              Read comment extension.
-            */
             comments=AcquireString((char *) NULL);
-            for (length=0; ; length+=count)
+            extent=MagickPathExtent;
+            for (offset=0; ; offset+=count)
             {
-              count=(ssize_t) ReadBlobBlock(image,buffer);
+              count=ReadBlobBlock(image,buffer);
               if (count == 0)
                 break;
               buffer[count]='\0';
-              (void) ConcatenateString(&comments,(const char *) buffer);
-            }
-            (void) SetImageProperty(meta_image,"comment",comments,exception);
-            comments=DestroyString(comments);
+              if ((count+offset+MagickPathExtent) >= extent)
+                {
+                  extent<<=1;
+                  comments=(char *) ResizeQuantumMemory(comments,extent+
+                    MagickPathExtent,sizeof(*comments));
+                  if (comments == (char *) NULL)
+                    ThrowGIFException(ResourceLimitError,
+                      "MemoryAllocationFailed");
+                }
+              (void) CopyMagickMemory(&comments[offset],(char *) buffer,extent-
+                offset);
             break;
           }
           case 0xff: