commit 6b71f22093fc4abb2da39f5a58b29c45c17ff99a
author Nicolas Pena <npm@chromium.org> Mon Jan 16 13:27:06 2017 -0500
committer Chromium commit bot <commit-bot@chromium.org> Mon Jan 16 22:24:15 2017 +0000
tree ad94c13914c59ad30191af043699485702c3c0cd
parent ff920ae3e181de9275f1d4c9b4b54fe2a7a54560

Return early when gif_img_row_bytes is 0

We can get into a loop when gif_img_row_bytes is 0 since Decode will
return 3 when the second parameter is 0, and there is a while(ret!=0).

BUG=681170

Change-Id: I63502a8487c07030fce2373f74cec6b4f0c98297
Reviewed-on: https://pdfium-review.googlesource.com/2211
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>

core/fxcodec/lgif/fx_gif.cpp

diff --git a/core/fxcodec/lgif/fx_gif.cpp b/core/fxcodec/lgif/fx_gif.cpp
index 43a6460..93db181 100644
--- a/core/fxcodec/lgif/fx_gif.cpp
+++ b/core/fxcodec/lgif/fx_gif.cpp
@@ -841,6 +841,10 @@
   uint32_t skip_size_org = gif_ptr->skip_size;
   GifImage* gif_image_ptr = (*gif_ptr->img_ptr_arr_ptr)[frame_num];
   uint32_t gif_img_row_bytes = gif_image_ptr->image_info_ptr->width;
+  if (gif_img_row_bytes == 0) {
+    gif_error(gif_ptr, "Error Invalid Number of Row Bytes");
+    return 0;
+  }
   if (gif_ptr->decode_status == GIF_D_STATUS_TAIL) {
     if (gif_image_ptr->image_row_buf) {
       FX_Free(gif_image_ptr->image_row_buf);