fix 617135

core/fxcodec/lgif/fx_gif.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/lgif/fx_gif.h"
 
 #include "core/fxcodec/lbmp/fx_bmp.h"
 
@@ skipping 907 matching lines @@
         return 2;
       }
       img_decoder_ptr->Input(data_ptr, *data_size_ptr);
       gif_save_decoding_status(gif_ptr, GIF_D_STATUS_IMG_DATA);
       gif_ptr->img_row_offset += gif_ptr->img_row_avail_size;
       gif_ptr->img_row_avail_size = gif_img_row_bytes - gif_ptr->img_row_offset;
       int32_t ret = img_decoder_ptr->Decode(
           gif_image_ptr->image_row_buf + gif_ptr->img_row_offset,
           gif_ptr->img_row_avail_size);
       if (ret == 0) {
-        FX_Free(gif_image_ptr->image_row_buf);
-        gif_image_ptr->image_row_buf = nullptr;
-        gif_save_decoding_status(gif_ptr, GIF_D_STATUS_TAIL);
-        gif_error(gif_ptr, "Decode Image Data Error");
+        gif_decoding_failure_at_tail_cleanup(gif_ptr, gif_image_ptr);
         return 0;
       }
       while (ret != 0) {
         if (ret == 1) {
           gif_ptr->gif_get_row_fn(gif_ptr, gif_image_ptr->image_row_num,
                                   gif_image_ptr->image_row_buf);
           FX_Free(gif_image_ptr->image_row_buf);
           gif_image_ptr->image_row_buf = nullptr;
           gif_save_decoding_status(gif_ptr, GIF_D_STATUS_TAIL);
           return 1;
@@ skipping 21 matching lines @@
         }
         if (ret == 3) {
           if (((GifLF*)&gif_image_ptr->image_info_ptr->local_flag)->interlace) {
             gif_ptr->gif_get_row_fn(gif_ptr, gif_image_ptr->image_row_num,
                                     gif_image_ptr->image_row_buf);
             gif_image_ptr->image_row_num +=
                 s_gif_interlace_step[gif_ptr->img_pass_num];
             if (gif_image_ptr->image_row_num >=
                 (int32_t)gif_image_ptr->image_info_ptr->height) {
               gif_ptr->img_pass_num++;
+              if (gif_ptr->img_pass_num == FX_ArraySize(s_gif_interlace_step)) {
+                gif_decoding_failure_at_tail_cleanup(gif_ptr, gif_image_ptr);
+                return 0;
+              }
               gif_image_ptr->image_row_num =
                   s_gif_interlace_step[gif_ptr->img_pass_num] / 2;
             }
           } else {
             gif_ptr->gif_get_row_fn(gif_ptr, gif_image_ptr->image_row_num++,
                                     gif_image_ptr->image_row_buf);
           }
           gif_ptr->img_row_offset = 0;
           gif_ptr->img_row_avail_size = gif_img_row_bytes;
           ret = img_decoder_ptr->Decode(
               gif_image_ptr->image_row_buf + gif_ptr->img_row_offset,
               gif_ptr->img_row_avail_size);
         }
         if (ret == 0) {
-          FX_Free(gif_image_ptr->image_row_buf);
-          gif_image_ptr->image_row_buf = nullptr;
-          gif_save_decoding_status(gif_ptr, GIF_D_STATUS_TAIL);
-          gif_error(gif_ptr, "Decode Image Data Error");
+          gif_decoding_failure_at_tail_cleanup(gif_ptr, gif_image_ptr);
           return 0;
         }
       }
     }
     gif_save_decoding_status(gif_ptr, GIF_D_STATUS_TAIL);
   }
   gif_error(gif_ptr, "Decode Image Data Error");
   return 0;
 }
+void gif_decoding_failure_at_tail_cleanup(gif_decompress_struct_p gif_ptr,
+                                          GifImage* gif_image_ptr) {
+  FX_Free(gif_image_ptr->image_row_buf);
+  gif_image_ptr->image_row_buf = nullptr;
+  gif_save_decoding_status(gif_ptr, GIF_D_STATUS_TAIL);
+  gif_error(gif_ptr, "Decode Image Data Error");
+}
 void gif_save_decoding_status(gif_decompress_struct_p gif_ptr, int32_t status) {
   gif_ptr->decode_status = status;
   gif_ptr->next_in += gif_ptr->skip_size;
   gif_ptr->avail_in -= gif_ptr->skip_size;
   gif_ptr->skip_size = 0;
 }
 uint8_t* gif_read_data(gif_decompress_struct_p gif_ptr,
                        uint8_t** des_buf_pp,
                        uint32_t data_size) {
   if (!gif_ptr || gif_ptr->avail_in < gif_ptr->skip_size + data_size)
@@ skipping 221 matching lines @@
     gif_ptr->cur_offset = cur_offset;
     res = FALSE;
   }
   dst_len = gif_ptr->cur_offset;
   dst_buf[dst_len - 1] = GIF_SIG_TRAILER;
   if (res) {
     gif_ptr->frames++;
   }
   return res;
 }