See: http://cups.org/str.php?L3867 for details.

Index: filter/image-gif.c

===================================================================

--- filter/image-gif.c	(revision 9839)

+++ filter/image-gif.c	(working copy)

@@ -353,7 +353,7 @@

     * Read in another buffer...

     */

-    if ((count = gif_get_block (fp, buf + last_byte)) <= 0)

+    if ((count = gif_get_block(fp, buf + last_byte)) <= 0)

     {

      /*

       * Whoops, no more data!

@@ -582,20 +582,14 @@

     gif_get_code(fp, 0, 1);

    /*

-    * Wipe the decompressor table...

+    * Wipe the decompressor table (already mostly 0 due to the calloc above...)

     */

     fresh = 1;

-    for (i = 0; i < clear_code; i ++)

-    {

-      table[0][i] = 0;

+    for (i = 1; i < clear_code; i ++)

       table[1][i] = i;

-    }

-    for (; i < 4096; i ++)

-      table[0][i] = table[1][0] = 0;

-

     sp = stack;

     return (0);

@@ -605,30 +599,31 @@

     fresh = 0;

     do

+    {

       firstcode = oldcode = gif_get_code(fp, code_size, 0);

+    }

     while (firstcode == clear_code);

-    return (firstcode);

+    return (firstcode & 255);

   }

   else if (!table)

     return (0);

   if (sp > stack)

-    return (*--sp);

+    return ((*--sp) & 255);

-  while ((code = gif_get_code (fp, code_size, 0)) >= 0)

+  while ((code = gif_get_code(fp, code_size, 0)) >= 0)

   {

     if (code == clear_code)

     {

-      for (i = 0; i < clear_code; i ++)

-      {

-	table[0][i] = 0;

+     /*

+      * Clear/reset the compression table...

+      */

+

+      memset(table, 0, 2 * sizeof(gif_table_t));

+      for (i = 1; i < clear_code; i ++)

 	table[1][i] = i;

-      }

-      for (; i < 4096; i ++)

-	table[0][i] = table[1][i] = 0;

-

       code_size     = set_code_size + 1;

       max_code_size = 2 * clear_code;

       max_code      = clear_code + 2;

@@ -637,13 +632,12 @@

       firstcode = oldcode = gif_get_code(fp, code_size, 0);

-      return (firstcode);

+      return (firstcode & 255);

     }

-    else if (code == end_code)

+    else if (code == end_code || code > max_code)

     {

-      unsigned char	buf[260];

+      unsigned char	buf[260];	/* Block buffer */

-

       if (!gif_eof)

         while (gif_get_block(fp, buf) > 0);

@@ -652,7 +646,7 @@

     incode = code;

-    if (code >= max_code)

+    if (code == max_code)

     {

       *sp++ = firstcode;

       code  = oldcode;

@@ -686,10 +680,10 @@

     oldcode = incode;

     if (sp > stack)

-      return (*--sp);

+      return ((*--sp) & 255);

   }

-  return (code);

+  return (code & 255);

 }