Commit c125313b authored by Ell's avatar Ell

Issue #4605 - Invalid abr brush crashes GIMP

When loading ABR brushes, error out on negative scan-line lengths,
instead of trying to allocate a huge buffer.  This entire code
could use a whole lot more unsignedness, but this should cover the
crash.

(cherry picked from commit 52cb2edd)
parent 10e66aa2
Pipeline #151109 passed with stages
in 19 minutes and 28 seconds
......@@ -1131,7 +1131,7 @@ abr_rle_decode (GDataInputStream *input,
for (i = 0; i < height; i++)
{
cscanline_len[i] = abr_read_short (input, error);
if (error && *error)
if ((error && *error) || cscanline_len[i] <= 0)
goto err;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment