summaryrefslogtreecommitdiffstats
path: root/CVE-2026-4985.patch
blob: 12b538b5edfed110f5f3c5bd0325a6214627cdac (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
From a9ecd7a129f3f7177dfec3e0e7b48c87131ac410 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20L=C3=B6bl?= <dloebl.2000@gmail.com>
Date: Mon, 30 Mar 2026 13:04:27 +0200
Subject: [PATCH] fix potential undefined behavior in cgif_addframe (#112)

---
 src/cgif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/cgif.c b/src/cgif.c
index 7190a1f..d526aee 100644
--- a/src/cgif.c
+++ b/src/cgif.c
@@ -480,7 +480,7 @@ static void copyFrameConfig(CGIF_FrameConfig* pDest, CGIF_FrameConfig* pSrc) {
 int cgif_addframe(CGIF* pGIF, CGIF_FrameConfig* pConfig) {
   CGIF_Frame* pNewFrame;
   int         hasAlpha, hasSetTransp;
-  int         i;
+  uint32_t    i;
   cgif_result r;
 
   // check for previous errors
@@ -518,7 +518,7 @@ int cgif_addframe(CGIF* pGIF, CGIF_FrameConfig* pConfig) {
           sameFrame = 0;
         }
       } else {
-        for(i = 0; i < pGIF->config.width * pGIF->config.height; i++) {
+        for(i = 0; i < MULU16(pGIF->config.width, pGIF->config.height); i++) {
           if(cmpPixel(pGIF, pConfig, &pGIF->aFrames[pGIF->iHEAD]->config, pConfig->pImageData[i], pGIF->aFrames[pGIF->iHEAD]->config.pImageData[i])) {
             sameFrame = 0;
             break;