1 See: http://cups.org/str.php?L3867 for details.

     2 

     3 Index: filter/image-gif.c

     4 ===================================================================

     5 --- filter/image-gif.c	(revision 9839)

     6 +++ filter/image-gif.c	(working copy)

     7 @@ -353,7 +353,7 @@

     8      * Read in another buffer...

     9      */

    10  

    11 -    if ((count = gif_get_block (fp, buf + last_byte)) <= 0)

    12 +    if ((count = gif_get_block(fp, buf + last_byte)) <= 0)

    13      {

    14       /*

    15        * Whoops, no more data!

    16 @@ -582,20 +582,14 @@

    17      gif_get_code(fp, 0, 1);

    18  

    19     /*

    20 -    * Wipe the decompressor table...

    21 +    * Wipe the decompressor table (already mostly 0 due to the calloc above...)

    22      */

    23  

    24      fresh = 1;

    25  

    26 -    for (i = 0; i < clear_code; i ++)

    27 -    {

    28 -      table[0][i] = 0;

    29 +    for (i = 1; i < clear_code; i ++)

    30        table[1][i] = i;

    31 -    }

    32  

    33 -    for (; i < 4096; i ++)

    34 -      table[0][i] = table[1][0] = 0;

    35 -

    36      sp = stack;

    37  

    38      return (0);

    39 @@ -605,30 +599,31 @@

    40      fresh = 0;

    41  

    42      do

    43 +    {

    44        firstcode = oldcode = gif_get_code(fp, code_size, 0);

    45 +    }

    46      while (firstcode == clear_code);

    47  

    48 -    return (firstcode);

    49 +    return (firstcode & 255);

    50    }

    51    else if (!table)

    52      return (0);

    53  

    54    if (sp > stack)

    55 -    return (*--sp);

    56 +    return ((*--sp) & 255);

    57  

    58 -  while ((code = gif_get_code (fp, code_size, 0)) >= 0)

    59 +  while ((code = gif_get_code(fp, code_size, 0)) >= 0)

    60    {

    61      if (code == clear_code)

    62      {

    63 -      for (i = 0; i < clear_code; i ++)

    64 -      {

    65 -	table[0][i] = 0;

    66 +     /*

    67 +      * Clear/reset the compression table...

    68 +      */

    69 +

    70 +      memset(table, 0, 2 * sizeof(gif_table_t));

    71 +      for (i = 1; i < clear_code; i ++)

    72  	table[1][i] = i;

    73 -      }

    74  

    75 -      for (; i < 4096; i ++)

    76 -	table[0][i] = table[1][i] = 0;

    77 -

    78        code_size     = set_code_size + 1;

    79        max_code_size = 2 * clear_code;

    80        max_code      = clear_code + 2;

    81 @@ -637,13 +632,12 @@

    82  

    83        firstcode = oldcode = gif_get_code(fp, code_size, 0);

    84  

    85 -      return (firstcode);

    86 +      return (firstcode & 255);

    87      }

    88 -    else if (code == end_code)

    89 +    else if (code == end_code || code > max_code)

    90      {

    91 -      unsigned char	buf[260];

    92 +      unsigned char	buf[260];	/* Block buffer */

    93  

    94 -

    95        if (!gif_eof)

    96          while (gif_get_block(fp, buf) > 0);

    97  

    98 @@ -652,7 +646,7 @@

    99  

   100      incode = code;

   101  

   102 -    if (code >= max_code)

   103 +    if (code == max_code)

   104      {

   105        *sp++ = firstcode;

   106        code  = oldcode;

   107 @@ -686,10 +680,10 @@

   108      oldcode = incode;

   109  

   110      if (sp > stack)

   111 -      return (*--sp);

   112 +      return ((*--sp) & 255);

   113    }

   114  

   115 -  return (code);

   116 +  return (code & 255);

   117  }

   118  

   119