fix 617135

core/fxcodec/lgif/fx_gif.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/lgif/fx_gif.h"
 
 #include "core/fxcodec/lbmp/fx_bmp.h"
 
@@ skipping 952 matching lines @@
         }
         if (ret == 3) {
           if (((GifLF*)&gif_image_ptr->image_info_ptr->local_flag)->interlace) {
             gif_ptr->gif_get_row_fn(gif_ptr, gif_image_ptr->image_row_num,
                                     gif_image_ptr->image_row_buf);
             gif_image_ptr->image_row_num +=
                 s_gif_interlace_step[gif_ptr->img_pass_num];
             if (gif_image_ptr->image_row_num >=
                 (int32_t)gif_image_ptr->image_info_ptr->height) {
               gif_ptr->img_pass_num++;
+              if (gif_ptr->img_pass_num ==
+                  sizeof(s_gif_interlace_step) / sizeof(int32_t)) {

[Lei Zhang, 2016/08/10 14:58:31]

This can be: FX_ArraySize(s_gif_interlace_step)

+                FX_Free(gif_image_ptr->image_row_buf);

[Tom Sepez, 2016/08/10 17:23:22]

Nit: we do this same cleanup in at least 3 places in this function  (928, 975,
995) consider making a helper function as a follow-on.

+                gif_image_ptr->image_row_buf = nullptr;
+                gif_save_decoding_status(gif_ptr, GIF_D_STATUS_TAIL);
+                gif_error(gif_ptr, "Decode Image Data Error");
+                return 0;
+              }
               gif_image_ptr->image_row_num =
                   s_gif_interlace_step[gif_ptr->img_pass_num] / 2;
             }
           } else {
             gif_ptr->gif_get_row_fn(gif_ptr, gif_image_ptr->image_row_num++,
                                     gif_image_ptr->image_row_buf);
           }
           gif_ptr->img_row_offset = 0;
           gif_ptr->img_row_avail_size = gif_img_row_bytes;
           ret = img_decoder_ptr->Decode(
@@ skipping 248 matching lines @@
     gif_ptr->cur_offset = cur_offset;
     res = FALSE;
   }
   dst_len = gif_ptr->cur_offset;
   dst_buf[dst_len - 1] = GIF_SIG_TRAILER;
   if (res) {
     gif_ptr->frames++;
   }
   return res;
 }