cvs: php-src(PHP_5_1) /ext/gd/libgd gd_gif_in.c

pajoye Sat Sep 24 10:39:16 2005 EDT Modified files: (Branch: PHP_5_1) /php-src/ext/gd/libgd gd_gif_in.c Log: - MFH #33220, infinite loop while loading invalid GIF (nlopees) http://cvs.php.net/diff.php/php-src/ext/gd/libgd/gd_gif_in.c?r1=1.5.4.1&r2=1.5.4.2&ty=u Index: php-src/ext/gd/libgd/gd_gif_in.c diff -u php-src/ext/gd/libgd/gd_gif_in.c:1.5.4.1 php-src/ext/gd/libgd/gd_gif_in.c:1.5.4.2 --- php-src/ext/gd/libgd/gd_gif_in.c:1.5.4.1 Thu Aug 18 08:54:43 2005 +++ php-src/ext/gd/libgd/gd_gif_in.c Sat Sep 24 10:39:16 2005 @@ -259,13 +259,13 @@ if ((buf[0] & 0x1) != 0) *Transparent = buf[3]; - while (GetDataBlock(fd, (unsigned char*) buf) != 0) + while (GetDataBlock(fd, (unsigned char*) buf) > 0) ; return FALSE; default: break; } - while (GetDataBlock(fd, (unsigned char*) buf) != 0) + while (GetDataBlock(fd, (unsigned char*) buf) > 0) ; return FALSE; @@ -337,7 +337,7 @@ buf[0] = buf[last_byte-2]; buf[1] = buf[last_byte-1]; - if ((count = GetDataBlock(fd, &buf[2])) == 0) + if ((count = GetDataBlock(fd, &buf[2])) <= 0) done = TRUE; last_byte = 2 + count;