backport gifheight check

jcupitt · jcupitt · commit c17e69624378 · 2020-11-21T14:25:09.000Z
ensure gifheight can't oevrflow see #1892
diff --git a/ChangeLog b/ChangeLog
@@ -10,6 +10,7 @@
 - better GraphicsMagick image write [bfriesen]
 - add missing read loops to spng, heif, giflib and ppm load [kleisauke]
 - block zero width or height images from imagemagick load [Koen1999]
+- check for overflow in gifload height [lovell]
 
 6/9/20 started 8.10.2
 - update magicksave/load profile handling [kelilevi]
diff --git a/libvips/foreign/gifload.c b/libvips/foreign/gifload.c
@@ -700,8 +700,16 @@ vips_foreign_load_gif_scan_extension( VipsForeignLoadGif *gif )
 static int
 vips_foreign_load_gif_set_header( VipsForeignLoadGif *gif, VipsImage *image )
 {
+	const gint64 total_height = (gint64) gif->file->SHeight * gif->n;
+
+	if( total_height <= 0 || 
+		total_height > VIPS_MAX_COORD ) {
+		vips_error( "gifload", "%s", _( "image size out of bounds" ) );
+		return( -1 );
+	}
+
 	vips_image_init_fields( image,
-		gif->file->SWidth, gif->file->SHeight * gif->n,
+		gif->file->SWidth, total_height,
 		(gif->has_colour ? 3 : 1) + (gif->has_transparency ? 1 : 0),
 		VIPS_FORMAT_UCHAR, VIPS_CODING_NONE,
 		gif->has_colour ?
