Created attachment 3966 [details]
patch for SDL2_image-2.x

Commit https://hg.libsdl.org/SDL_image/rev/19beb4a1bb54 by Ryan
(gif: Don't get into infinite loops on truncated files) changes
a zero check to a zero-or-negative check in GetCode().  However,
the checked variable count is an unsigned char and we can never
catch negative returns from GetDataBlock() that way there.

I suggest something like the following (also attached):

diff --git a/IMG_gif.c b/IMG_gif.c
--- a/IMG_gif.c
+++ b/IMG_gif.c
@@ -405,8 +405,10 @@ GetCode(SDL_RWops *src, int code_size, i
         state->buf[0] = state->buf[state->last_byte - 2];
         state->buf[1] = state->buf[state->last_byte - 1];
 
-        if ((count = GetDataBlock(src, &state->buf[2], state)) <= 0)
+        ret = GetDataBlock(src, &state->buf[2], state);
+        if (ret <= 0)
             state->done = TRUE;
+        count = (ret > 0)? (unsigned char)ret : 0;
 
         state->last_byte = 2 + count;
         state->curbit = (state->curbit - state->lastbit) + 16;

We still aren't immediately returning, but at least we shall be
able to catch a truncated file.

OK to push?