From 5e690c3ff429025386837c4ff38e1761cd5e1d72 Mon Sep 17 00:00:00 2001
From: Ozkan Sezer <[EMAIL REDACTED]>
Date: Wed, 29 Apr 2026 08:18:09 -0700
Subject: [PATCH] Fixed out of bound read in GIF decoder
Fixes https://github.com/libsdl-org/SDL_image/issues/724
(manual backport of commit e2b258927d11438cbf4ee55a5c4ff059a6e32d08)
---
IMG_gif.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/IMG_gif.c b/IMG_gif.c
index df9dad99c..660d41291 100644
--- a/IMG_gif.c
+++ b/IMG_gif.c
@@ -406,8 +406,10 @@ GetCode(SDL_RWops *src, int code_size, int flag, State_t * state)
RWSetMsg("ran off the end of my bits");
return -1;
}
- state->buf[0] = state->buf[state->last_byte - 2];
- state->buf[1] = state->buf[state->last_byte - 1];
+ if (state->last_byte > 2) {
+ state->buf[0] = state->buf[state->last_byte - 2];
+ state->buf[1] = state->buf[state->last_byte - 1];
+ }
if ((ret = GetDataBlock(src, &state->buf[2], state)) > 0)
count = (unsigned char) ret;