Issue #4605 - Invalid abr brush crashes GIMP
When loading ABR brushes, error out on negative scan-line lengths, instead of trying to allocate a huge buffer. This entire code could use a whole lot more unsignedness, but this should cover the crash.
This commit is contained in:
@ -1131,7 +1131,7 @@ abr_rle_decode (GDataInputStream *input,
|
||||
for (i = 0; i < height; i++)
|
||||
{
|
||||
cscanline_len[i] = abr_read_short (input, error);
|
||||
if (error && *error)
|
||||
if ((error && *error) || cscanline_len[i] <= 0)
|
||||
goto err;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user