Merge pull request libvips#2179 from lovell/nsgifload-limit-dimensions

jcupitt · web-flow · commit c8363d4e612f · 2021-04-02T11:44:30.000+01:00
nsgifload: enforce maximum GIF dimensions of 16383
diff --git a/libvips/foreign/nsgifload.c b/libvips/foreign/nsgifload.c
@@ -534,17 +534,17 @@ vips_foreign_load_nsgif_class_init( VipsForeignLoadNsgifClass *class )
 static void *
 vips_foreign_load_nsgif_bitmap_create( int width, int height )
 {
-	/* Check GIF dimensions fit within 16-bit unsigned.
+	/* Enforce max GIF dimensions of 16383 (0x7FFF).
 	 */
 	if( width <= 0 ||
-		width > 65535 ||
+		width > 16383 ||
 		height <= 0 ||
-		height > 65535 ) {
+		height > 16383 ) {
 		vips_error( "gifload",
-			"%s", _( "dimensions out of range ") );
+			"%s", _( "bad image dimensions") );
 		return( NULL );
 	}
-	return g_malloc0( width * height * 4 );
+	return g_malloc0( (gsize) width * height * 4 );
 }
 
 static void 
