Author: dynis Date: Sun Jun 22 12:17:04 2008 New Revision: 4422 URL: http://source.netsurf-browser.org?rev=4422&view=rev Log: Added consistency in the way block-data is skipped; corrected a buffering error that was causing some gif images to throw errors Modified: branches/dynis/libnsgif/libnsgif.c Modified: branches/dynis/libnsgif/libnsgif.c URL: http://source.netsurf-browser.org/branches/dynis/libnsgif/libnsgif.c?rev=... ============================================================================== --- branches/dynis/libnsgif/libnsgif.c (original) +++ branches/dynis/libnsgif/libnsgif.c Sun Jun 22 12:17:04 2008 @@ -450,24 +450,27 @@ else gif_data += (3 + extension_size); - /* Skip all the sub-blocks - */ - while (gif_data[0] != 0x00) - gif_data += gif_data[0] + 1; - gif_data++; + /* Repeatedly skip blocks until we get a zero block or run out of data + * This library does not process this data + */ + block_size = 0; + while (block_size != 1) { + block_size = gif_data[0] + 1; + if ((gif_bytes -= block_size) < 0) + return GIF_INSUFFICIENT_FRAME_DATA; + gif_data += block_size; + } } /* Check if we've finished */ - gif_bytes = (gif_end - gif_data); - if (gif_bytes < 1) + if ((gif_bytes = (gif_end - gif_data)) < 1) return GIF_INSUFFICIENT_FRAME_DATA; - else - if (gif_data[0] == GIF_TRAILER) { - gif->buffer_position = gif_data - gif->gif_data; - gif->frame_count = frame + 1; - return 1; - } + else if (gif_data[0] == GIF_TRAILER) { + gif->buffer_position = gif_data - gif->gif_data; + gif->frame_count = frame + 1; + return 1; + } /* If we're not done, there should be an image descriptor */ @@ -549,8 +552,6 @@ */ block_size = 0; while (block_size != 1) { - /* Skip the block data - */ block_size = gif_data[0] + 1; if ((gif_bytes -= block_size) < 0) return GIF_INSUFFICIENT_FRAME_DATA; @@ -700,17 +701,24 @@ gif_data += 2; else gif_data += (3 + extension_size); - - /* Skip all the sub-blocks - */ - while (gif_data[0] != 0x00) - gif_data += gif_data[0] + 1; - gif_data++; + + /* Repeatedly skip blocks until we get a zero block or run out of data + * This library does not process this data + */ + block_size = 0; + while (block_size != 1) { + block_size = gif_data[0] + 1; + if ((gif_bytes -= block_size) < 0) { + return_value = GIF_INSUFFICIENT_FRAME_DATA; + goto gif_decode_frame_exit; + } + gif_data += block_size; + } } /* Ensure we have enough data for the 10-byte image descriptor + 1-byte gif trailer */ - if ((gif_bytes = (gif_end - gif_data)) < 12) { + if (gif_bytes < 12) { return_value = GIF_INSUFFICIENT_FRAME_DATA; break; } @@ -876,8 +884,6 @@ gif_data = gif->gif_data + gif->buffer_size; block_size = 0; while (block_size != 1) { - /* Skip the block data - */ block_size = gif_data[0] + 1; if ((gif_bytes -= block_size) < 0) { return_value = GIF_INSUFFICIENT_FRAME_DATA; @@ -887,12 +893,12 @@ } } gif_decode_frame_exit: - /* Check for end of data */ + gif->buffer_position++; gif_bytes = gif->buffer_size - gif->buffer_position; + gif_data = gif->gif_data + gif->buffer_position; more_images &= !((gif_bytes < 1) || (gif_data[0] == GIF_TRAILER)); - gif->buffer_position++; } /* Check if we should test for optimisation