mirror of https://github.com/GNOME/gimp.git
Issue #4605 - Invalid abr brush crashes GIMP
When loading ABR brushes, error out on negative scan-line lengths, instead of trying to allocate a huge buffer. This entire code could use a whole lot more unsignedness, but this should cover the crash.
This commit is contained in:
parent
782e209a33
commit
52cb2edd9e
|
@ -1131,7 +1131,7 @@ abr_rle_decode (GDataInputStream *input,
|
|||
for (i = 0; i < height; i++)
|
||||
{
|
||||
cscanline_len[i] = abr_read_short (input, error);
|
||||
if (error && *error)
|
||||
if ((error && *error) || cscanline_len[i] <= 0)
|
||||
goto err;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue