Ignore unsupported disposal methods when decoding GIF

Source/core/platform/image-decoders/gif/GIFImageReader.cpp

 /* -*- Mode: C; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
@@ skipping 538 matching lines @@
             addFrameIfNecessary();
             GIFFrameContext* currentFrame = m_frames.last().get();
             if (*currentComponent & 0x1)
                 currentFrame->setTransparentPixel(currentComponent[3]);
 
             // We ignore the "user input" bit.
 
             // NOTE: This relies on the values in the FrameDisposalMethod enum
             // matching those in the GIF spec!
             int disposalMethod = ((*currentComponent) >> 2) & 0x7;
-            currentFrame->setDisposalMethod(static_cast<WebCore::ImageFrame::DisposalMethod>(disposalMethod));
-            // Some specs say that disposal method 3 is "overwrite previous", others that setting
-            // the third bit of the field (i.e. method 4) is. We map both to the same value.
-            if (disposalMethod == 4)
+            if (disposalMethod < 4) {
+                currentFrame->setDisposalMethod(static_cast<WebCore::ImageFrame::DisposalMethod>(disposalMethod));
+            } else if (disposalMethod == 4) {
+                // Some specs say that disposal method 3 is "overwrite previous", others that setting
+                // the third bit of the field (i.e. method 4) is. We map both to the same value.
                 currentFrame->setDisposalMethod(WebCore::ImageFrame::DisposeOverwritePrevious);
+            }
             currentFrame->setDelayTime(GETINT16(currentComponent + 1) * 10);
             GETN(1, GIFConsumeBlock);
             break;
         }
 
         case GIFCommentExtension: {
             if (*currentComponent)
                 GETN(*currentComponent, GIFConsumeComment);
             else
                 GETN(1, GIFImageStart);
@@ skipping 208 matching lines @@
     // Clearing the whole suffix table lets us be more tolerant of bad data.
     memset(suffix, 0, sizeof(suffix));
 
     // Clearing the whole prefix table to prevent uninitialized access.
     memset(prefix, 0, sizeof(prefix));
     for (int i = 0; i < clearCode; i++)
         suffix[i] = i;
     stackp = 0;
     return true;
 }