SDL_image: Prevent state stack overrun when decoding a malformed GIF

SDL Commits
1 
From b0c94a0b1030303969ee29a88ca52ebaf87e15cb Mon Sep 17 00:00:00 2001
From: Sam Lantinga <[EMAIL REDACTED]>
Date: Wed, 26 Aug 2026 10:01:35 -0700
Subject: [PATCH] Prevent state stack overrun when decoding a malformed GIF

---
 src/IMG_gif.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/IMG_gif.c b/src/IMG_gif.c
index 334384513..a13bc3de6 100644
--- a/src/IMG_gif.c
+++ b/src/IMG_gif.c
@@ -372,6 +372,10 @@ LWZReadByte(SDL_IOStream *src, int flag, int input_code_size, State_t * state)
                 RWSetMsg("invalid LWZ data");
                 return -3;
             }
+            if (state->sp == &state->stack[SDL_arraysize(state->stack)]) {
+                RWSetMsg("invalid LWZ data");
+                return -3;
+            }
             *state->sp++ = state->table[1][code];
             if (code == state->table[0][code]) {
                 RWSetMsg("circular table entry BIG ERROR");
@@ -385,6 +389,10 @@ LWZReadByte(SDL_IOStream *src, int flag, int input_code_size, State_t * state)
             RWSetMsg("invalid LWZ data");
             return -4;
         }
+        if (state->sp == &state->stack[SDL_arraysize(state->stack)]) {
+            RWSetMsg("invalid LWZ data");
+            return -4;
+        }
         *state->sp++ = state->firstcode = state->table[1][code];
 
         if ((code = state->max_code) < (1 << MAX_LWZ_BITS)) {