From d8c83940d6ae196e9f800c970877838d42794e1d Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Tue, 14 Jul 2015 12:43:05 +0100 Subject: use same limit in ProcessOneCode as AddToTable Change-Id: Id0345e5d867d18bf7eb341f04086226b7fa79680 (cherry picked from commit 59197f1892777a5629bad210b9ed1071ed550570) Reviewed-on: https://gerrit.libreoffice.org/17040 Reviewed-by: Michael Stahl Tested-by: Michael Stahl --- vcl/source/filter/igif/decode.cxx | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/vcl/source/filter/igif/decode.cxx b/vcl/source/filter/igif/decode.cxx index 24b25ace91a9..a8e49e6abd8d 100644 --- a/vcl/source/filter/igif/decode.cxx +++ b/vcl/source/filter/igif/decode.cxx @@ -109,11 +109,9 @@ HPBYTE GIFLZWDecompressor::DecompressBlock( HPBYTE pSrc, sal_uInt8 cBufSize, bool GIFLZWDecompressor::AddToTable( sal_uInt16 nPrevCode, sal_uInt16 nCodeFirstData ) { - GIFLZWTableEntry* pE; - if( nTableSize < 4096 ) { - pE = pTable + nTableSize; + GIFLZWTableEntry* pE = pTable + nTableSize; pE->pPrev = pTable + nPrevCode; pE->pFirst = pE->pPrev->pFirst; GIFLZWTableEntry *pEntry = pTable[nCodeFirstData].pFirst; @@ -130,7 +128,6 @@ bool GIFLZWDecompressor::AddToTable( sal_uInt16 nPrevCode, sal_uInt16 nCodeFirst bool GIFLZWDecompressor::ProcessOneCode() { - GIFLZWTableEntry* pE; sal_uInt16 nCode; bool bRet = false; bool bEndOfBlock = false; @@ -193,11 +190,11 @@ bool GIFLZWDecompressor::ProcessOneCode() nOldCode = nCode; - if (nCode > 4096) + if (nCode >= 4096) return false; // write character(/-sequence) of code nCode in the output buffer: - pE = pTable + nCode; + GIFLZWTableEntry* pE = pTable + nCode; do { if (pOutBufData == pOutBuf) //can't go back past start -- cgit v1.2.3