@@ -39,17 +39,13 @@ proc decodeGif*(data: string): Gif {.raises: [PixieError].} =
3939 hasGlobalColorTable = (globalFlags and 0b 10000000 ) != 0
4040 globalColorTableSize = 2 ^ ((globalFlags and 0b 00000111 ) + 1 )
4141 bgColorIndex = data.readUint8 (11 ).int
42- pixelAspectRatio = data.readUint8 (12 )
4342
44- if bgColorIndex >= globalColorTableSize:
43+ if hasGlobalColorTable and bgColorIndex >= globalColorTableSize:
4544 failInvalid ()
4645
47- if pixelAspectRatio != 0 :
48- raise newException (PixieError , " Unsupported GIF, pixel aspect ratio" )
49-
5046 var pos = 13
5147
52- if pos + globalColorTableSize * 3 > data.len:
48+ if hasGlobalColorTable and pos + globalColorTableSize * 3 > data.len:
5349 failInvalid ()
5450
5551 var
@@ -79,6 +75,8 @@ proc decodeGif*(data: string): Gif {.raises: [PixieError].} =
7975 break
8076
8177 pos += subBlockSize
78+ if pos > data.len:
79+ failInvalid ()
8280
8381 var controlExtension: ControlExtension
8482 while true :
@@ -98,7 +96,7 @@ proc decodeGif*(data: string): Gif {.raises: [PixieError].} =
9896 imageTopPos = data.readUint16 (pos + 2 ).int
9997 imageWidth = data.readUint16 (pos + 4 ).int
10098 imageHeight = data.readUint16 (pos + 6 ).int
101- imageFlags = data.readUint16 (pos + 8 )
99+ imageFlags = data.readUint8 (pos + 8 )
102100 hasLocalColorTable = (imageFlags and 0b 10000000 ) != 0
103101 interlaced = (imageFlags and 0b 01000000 ) != 0
104102 localColorTableSize = 2 ^ ((imageFlags and 0b 00000111 ) + 1 )
@@ -108,7 +106,7 @@ proc decodeGif*(data: string): Gif {.raises: [PixieError].} =
108106 if imageWidth > screenWidth or imageHeight > screenHeight:
109107 raise newException (PixieError , " Invalid GIF frame dimensions" )
110108
111- if pos + localColorTableSize * 3 > data.len:
109+ if hasLocalColorTable and pos + localColorTableSize * 3 > data.len:
112110 failInvalid ()
113111
114112 var localColorTable: seq [ColorRGBX ]
@@ -129,7 +127,7 @@ proc decodeGif*(data: string): Gif {.raises: [PixieError].} =
129127 let minCodeSize = data.readUint8 (pos).int
130128 inc pos
131129
132- if minCodeSize > 11 :
130+ if minCodeSize < 2 or minCodeSize > 8 :
133131 failInvalid ()
134132
135133 # The image data is contained in a sequence of sub-blocks
0 commit comments