Don't crash for GIF frames with 0 width/height
Summary:
If a GIF frame had a width and/or height of 0, Fresco crashes due to a division by 0.
Sample GIF that includes such frames:
Fixes
@@ -313,9 +313,14 @@ int readSingleFrame(
}
SavedImage* pSavedImage = &pGifFile->SavedImages[pGifFile->ImageCount - 1];
- // Check size of image.
- if (pSavedImage->ImageDesc.Width <= 0 &&
- pSavedImage->ImageDesc.Height <= 0 &&
+ // Check size of image. Note: Frames with 0 width or height should be allowed.
+ if (pSavedImage->ImageDesc.Width < 0 || pSavedImage->ImageDesc.Height < 0) {
+ return GIF_ERROR;
+ }
+
+ // Check for image size overflow.
+ if (pSavedImage->ImageDesc.Width > 0 &&
+ pSavedImage->ImageDesc.Height > 0 &&
pSavedImage->ImageDesc.Width > (INT_MAX / pSavedImage->ImageDesc.Height)) {
return GIF_ERROR;
}
