[gdk-pixbuf: 1/2] gif: Check for overflow when compositing or clearing frames.

[Emmanuele Bassi <ebassi src gnome org>]

commit 6976bdc8ee9dd2c2954f91066f7b0f643769a379
Author: Robert Ancell <robert ancell canonical com>
Date:   Thu Jun 3 11:05:56 2021 +1200

    gif: Check for overflow when compositing or clearing frames.
    
    Fixes: #190
    
    Similar to fix in 086e8adf4cc352cd11572f96066b001b545f354e

 gdk-pixbuf/io-gif-animation.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)
---
diff --git a/gdk-pixbuf/io-gif-animation.c b/gdk-pixbuf/io-gif-animation.c
index 8335cdd76..71d9265e6 100644
--- a/gdk-pixbuf/io-gif-animation.c
+++ b/gdk-pixbuf/io-gif-animation.c
@@ -369,7 +369,7 @@ composite_frame (GdkPixbufGifAnim *anim, GdkPixbufFrame *frame)
         for (i = 0; i < n_indexes; i++) {
                 guint8 index = index_buffer[i];
                 guint x, y;
-                int offset;
+                gsize offset;
 
                 if (index == frame->transparent_index)
                         continue;
@@ -379,11 +379,13 @@ composite_frame (GdkPixbufGifAnim *anim, GdkPixbufFrame *frame)
                 if (x >= anim->width || y >= anim->height)
                         continue;
 
-                offset = y * gdk_pixbuf_get_rowstride (anim->last_frame_data) + x * 4;
-                pixels[offset + 0] = frame->color_map[index * 3 + 0];
-                pixels[offset + 1] = frame->color_map[index * 3 + 1];
-                pixels[offset + 2] = frame->color_map[index * 3 + 2];
-                pixels[offset + 3] = 255;
+                if (g_size_checked_mul (&offset, gdk_pixbuf_get_rowstride (anim->last_frame_data), y) &&
+                    g_size_checked_add (&offset, offset, x * 4)) {
+                        pixels[offset + 0] = frame->color_map[index * 3 + 0];
+                        pixels[offset + 1] = frame->color_map[index * 3 + 1];
+                        pixels[offset + 2] = frame->color_map[index * 3 + 2];
+                        pixels[offset + 3] = 255;
+                }
         }
 
 out:
@@ -448,8 +450,11 @@ gdk_pixbuf_gif_anim_iter_get_pixbuf (GdkPixbufAnimationIter *anim_iter)
                         x_end = MIN (anim->last_frame->x_offset + anim->last_frame->width, anim->width);
                         y_end = MIN (anim->last_frame->y_offset + anim->last_frame->height, anim->height);
                         for (y = anim->last_frame->y_offset; y < y_end; y++) {
-                                guchar *line = pixels + y * gdk_pixbuf_get_rowstride (anim->last_frame_data) 
+ anim->last_frame->x_offset * 4;
-                                memset (line, 0, (x_end - anim->last_frame->x_offset) * 4);
+                                gsize offset;
+                                if (g_size_checked_mul (&offset, gdk_pixbuf_get_rowstride 
(anim->last_frame_data), y) &&
+                                    g_size_checked_add (&offset, offset, anim->last_frame->x_offset * 4)) {
+                                         memset (pixels + offset, 0, (x_end - anim->last_frame->x_offset) * 
4);
+                                }
                         }
                         break;
                 case GDK_PIXBUF_FRAME_REVERT: