Mirrors_UI_SDK/wxWidgets
1
0
Fork 0
mirror of https://github.com/wxWidgets/wxWidgets.git synced 2026-09-23 06:33:59 +08:00
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Fix palette buffer overflow in wxGIFHandler::SaveFile()

Browse Source 
The image palette can have more than the 256 entries a GIF supports, for
example when the image was loaded from an XPM that declares a larger
colour count. wxGIFHandler_GetPalette(), called when saving a GIF,
copied every entry into the caller's fixed wxRGB pal[256] buffer,
overflowing it.

Such an image can't be represented as a GIF, so reject the save with an
error message instead of overflowing the buffer or writing out a silently
truncated palette.

Closes #26532.
This commit is contained in:
dxbjavid
2026-05-31 15:45:18 +02:00
committed by Vadim Zeitlin
parent a3ad8e3360
commit e4a462d4bc
2 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/image/image.cpp
+24
View File
@@ -1304,6 +1304,30 @@ TEST_CASE_METHOD(ImageHandlersInit, "wxImage::SaveAnimatedGIF", "[image]")
#endif // #if wxUSE_PALETTE
}
TEST_CASE_METHOD(ImageHandlersInit, "wxImage::SaveGIFBigPalette", "[image][gif][error]")
{
#if wxUSE_PALETTE
// An image palette can have more than the 256 entries a GIF supports, for
// instance when the image was loaded from an XPM declaring a larger colour
// count. Saving such an image as GIF must not overflow the fixed 256-entry
// palette buffer used by the encoder; instead the save should fail cleanly.
const int numColours = 300;
unsigned char r[numColours], g[numColours], b[numColours];
for (int i = 0; i < numColours; ++i)
{
r[i] = g[i] = b[i] = static_cast<unsigned char>(i);
}
wxImage image(1, 1);
image.SetRGB(0, 0, 0, 0, 0);
image.SetPalette(wxPalette(numColours, r, g, b));
wxMemoryOutputStream memOut;
wxLogNull noLog;
CHECK( !image.SaveFile(memOut, wxBITMAP_TYPE_GIF) );
#endif // wxUSE_PALETTE
}
static void TestGIFComment(const wxString& comment)
{
wxImage image("horse.gif");