We are currently migrating Bugzilla to GitHub issues.
Any changes made to the bug tracker now will be lost, so please do not post new bugs or make changes to them.
When we're done, all bug URLs will redirect to their equivalent location on the new bug tracker.

Created attachment 3966 [details]
patch for SDL2_image-2.x

Commit https://hg.libsdl.org/SDL_image/rev/19beb4a1bb54 by Ryan
(gif: Don't get into infinite loops on truncated files) changes
a zero check to a zero-or-negative check in GetCode().  However,
the checked variable count is an unsigned char and we can never
catch negative returns from GetDataBlock() that way there.

I suggest something like the following (also attached):

diff --git a/IMG_gif.c b/IMG_gif.c
--- a/IMG_gif.c
+++ b/IMG_gif.c
@@ -405,8 +405,10 @@ GetCode(SDL_RWops *src, int code_size, i
         state->buf[0] = state->buf[state->last_byte - 2];
         state->buf[1] = state->buf[state->last_byte - 1];
 
-        if ((count = GetDataBlock(src, &state->buf[2], state)) <= 0)
+        ret = GetDataBlock(src, &state->buf[2], state);
+        if (ret <= 0)
             state->done = TRUE;
+        count = (ret > 0)? (unsigned char)ret : 0;
 
         state->last_byte = 2 + count;
         state->curbit = (state->curbit - state->lastbit) + 16;

We still aren't immediately returning, but at least we shall be
able to catch a truncated file.

OK to push?