Return early when gif_img_row_bytes is 0 We can get into a loop when gif_img_row_bytes is 0 since Decode will return 3 when the second parameter is 0, and there is a while(ret!=0). BUG=681170 Change-Id: I63502a8487c07030fce2373f74cec6b4f0c98297 Reviewed-on: https://pdfium-review.googlesource.com/2211 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: dsinclair <dsinclair@chromium.org>
diff --git a/core/fxcodec/lgif/fx_gif.cpp b/core/fxcodec/lgif/fx_gif.cpp index 43a6460..93db181 100644 --- a/core/fxcodec/lgif/fx_gif.cpp +++ b/core/fxcodec/lgif/fx_gif.cpp
@@ -841,6 +841,10 @@ uint32_t skip_size_org = gif_ptr->skip_size; GifImage* gif_image_ptr = (*gif_ptr->img_ptr_arr_ptr)[frame_num]; uint32_t gif_img_row_bytes = gif_image_ptr->image_info_ptr->width; + if (gif_img_row_bytes == 0) { + gif_error(gif_ptr, "Error Invalid Number of Row Bytes"); + return 0; + } if (gif_ptr->decode_status == GIF_D_STATUS_TAIL) { if (gif_image_ptr->image_row_buf) { FX_Free(gif_image_ptr->image_row_buf);