From: Cristy <urban-warrior@imagemagick.org>
Date: Thu, 25 Oct 2018 12:09:30 +0000 (-0400)
Subject: ...
X-Git-Tag: 7.0.8-15~113
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fc81031c906426d42d66169759d89835dd71b240;p=imagemagick

...
---

diff --git a/coders/gif.c b/coders/gif.c
index aeef70694..109ef16d2 100644
--- a/coders/gif.c
+++ b/coders/gif.c
@@ -1085,22 +1085,28 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
               *comments;
 
             size_t
-              length;
+              extent,
+              offset;
 
-            /*
-              Read comment extension.
-            */
             comments=AcquireString((char *) NULL);
-            for (length=0; ; length+=count)
+            extent=MagickPathExtent;
+            for (offset=0; ; offset+=count)
             {
-              count=(ssize_t) ReadBlobBlock(image,buffer);
+              count=ReadBlobBlock(image,buffer);
               if (count == 0)
                 break;
               buffer[count]='\0';
-              (void) ConcatenateString(&comments,(const char *) buffer);
-            }
-            (void) SetImageProperty(meta_image,"comment",comments,exception);
-            comments=DestroyString(comments);
+              if ((count+offset+MagickPathExtent) >= extent)
+                {
+                  extent<<=1;
+                  comments=(char *) ResizeQuantumMemory(comments,extent+
+                    MagickPathExtent,sizeof(*comments));
+                  if (comments == (char *) NULL)
+                    ThrowGIFException(ResourceLimitError,
+                      "MemoryAllocationFailed");
+                }
+              (void) CopyMagickMemory(&comments[offset],(char *) buffer,extent-
+                offset);
             break;
           }
           case 0xff: