handle zero length extensions correctly

diff --git a/Changes b/Changes
index e26744732a5d7307afb3ccec08ebaabd76906067..fe2db308ce83779814fc18261a2c5610a72c8976 100644 (file)
--- a/Changes
+++ b/Changes
@@ -1,5 +1,17 @@
 Imager release history.  Older releases can be found in Changes.old
 
+Imager 0.70 - unreleased
+===========
+
+Bug fixes:
+
+ - release image row and comments memory on all error returns in gif
+   reader
+
+ - handle zero length extensions, previously this would cause a null
+   pointer dereference
+   Thanks to Krzysztof Wojtaś for the test data and fix for this.
+
 Imager 0.69 - 08 Sep 2009
 ===========
 

diff --git a/MANIFEST b/MANIFEST
index 297eaab7cf0d37a92747ea6201bffb3a3a42cbc1..eda895fc84522fbd0705f6b4ec859fe2a2558db6 100644 (file)
--- a/MANIFEST
+++ b/MANIFEST
@@ -387,6 +387,7 @@ testimg/winrgb4off.bmp  4-bit bmp with image data offset from header
 testimg/winrgb8.bmp  8-bit bmp base
 testimg/winrgb8off.bmp  8-bit bmp with image data offset from header
 testimg/zerotype.jpg   Image with a zero type entry in the EXIF data
+testimg/zerocomm.gif   Image with a zero-length comment extension
 tga.c           Reading and writing Targa files
 tiff.c
 trans2.c

diff --git a/gif.c b/gif.c
index 23e76714994b81209e9a168c1a8e2e3bf9f6606c..12c8653358990e0594a1f1ff5bde88169d16ca1a 100644 (file)
--- a/gif.c
+++ b/gif.c
@@ -796,6 +796,9 @@ i_img **i_readgif_multi_low(GifFileType *GifFile, int *count, int page) {
          myfree(comment);
        return NULL;
       }
+      /* possibly this should be an error, but "be liberal in what you accept" */
+      if (!Extension)
+       break;
       if (ExtCode == 0xF9) {
         got_gce = 1;
         if (Extension[1] & 1)

diff --git a/t/t105gif.t b/t/t105gif.t
index 2c0ef2ca4f9e1ac24508ad9192f649de8c3c85b4..7514ac218e91bc065be83ff6ebbf29b765a56a2c 100644 (file)
--- a/t/t105gif.t
+++ b/t/t105gif.t
@@ -26,7 +26,7 @@ init_log("testout/t105gif.log",1);
 i_has_format("gif")
   or plan skip_all => "no gif support";
 
-plan tests => 145;
+plan tests => 146;
 
 my $green=i_color_new(0,255,0,255);
 my $blue=i_color_new(0,0,255,255);
@@ -743,6 +743,11 @@ SKIP:
   is_color3($colors[8], 0, 0x33, 0x66, "9th should be 003366");
 }
 
+{ # a zero length extension could make read_/read_multi crash
+  my ($im) = Imager->read_multi(file => "testimg/zerocomm.gif");
+  ok($im, "read image with zero-length extension");
+}
+
 sub test_readgif_cb {
   my ($size) = @_;
 

diff --git a/testimg/zerocomm.gif b/testimg/zerocomm.gif
new file mode 100644 (file)
index 0000000..ede9f6a
Binary files /dev/null and b/testimg/zerocomm.gif differ