src/java.desktop/share/native/libsplashscreen/giflib/gifalloc.c

@@ -31,10 +31,11 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 
 #include "gif_lib.h"
+#include "gif_lib_private.h"
 
 #define MAX(x, y)    (((x) > (y)) ? (x) : (y))
 
 /******************************************************************************
  Miscellaneous utility functions

@@ -346,19 +347,21 @@
 SavedImage *
 GifMakeSavedImage(GifFileType *GifFile, const SavedImage *CopyFrom)
 {
     if (GifFile->SavedImages == NULL)
         GifFile->SavedImages = (SavedImage *)malloc(sizeof(SavedImage));
-    else
-        GifFile->SavedImages = (SavedImage *)reallocarray(GifFile->SavedImages,
+    else {
+        SavedImage* newSavedImages = (SavedImage *)reallocarray(GifFile->SavedImages,
                                (GifFile->ImageCount + 1), sizeof(SavedImage));
-
+        if( newSavedImages == NULL)
+            return ((SavedImage *)NULL);
+        GifFile->SavedImages = newSavedImages;
+    }
     if (GifFile->SavedImages == NULL)
         return ((SavedImage *)NULL);
     else {
         SavedImage *sp = &GifFile->SavedImages[GifFile->ImageCount++];
-        memset((char *)sp, '\0', sizeof(SavedImage));
 
         if (CopyFrom != NULL) {
             memcpy((char *)sp, CopyFrom, sizeof(SavedImage));
 
             /*

@@ -366,11 +369,11 @@
              * copied record.  This guards against potential aliasing
              * problems.
              */
 
             /* first, the local color map */
-            if (sp->ImageDesc.ColorMap != NULL) {
+            if (CopyFrom->ImageDesc.ColorMap != NULL) {
                 sp->ImageDesc.ColorMap = GifMakeMapObject(
                                          CopyFrom->ImageDesc.ColorMap->ColorCount,
                                          CopyFrom->ImageDesc.ColorMap->Colors);
                 if (sp->ImageDesc.ColorMap == NULL) {
                     FreeLastSavedImage(GifFile);

@@ -390,11 +393,11 @@
             memcpy(sp->RasterBits, CopyFrom->RasterBits,
                    sizeof(GifPixelType) * CopyFrom->ImageDesc.Height *
                    CopyFrom->ImageDesc.Width);
 
             /* finally, the extension blocks */
-            if (sp->ExtensionBlocks != NULL) {
+            if (CopyFrom->ExtensionBlocks != NULL) {
                 sp->ExtensionBlocks = (ExtensionBlock *)reallocarray(NULL,
                                       CopyFrom->ExtensionBlockCount,
                                       sizeof(ExtensionBlock));
                 if (sp->ExtensionBlocks == NULL) {
                     FreeLastSavedImage(GifFile);

@@ -402,10 +405,13 @@
                 }
                 memcpy(sp->ExtensionBlocks, CopyFrom->ExtensionBlocks,
                        sizeof(ExtensionBlock) * CopyFrom->ExtensionBlockCount);
             }
         }
+        else {
+            memset((char *)sp, '\0', sizeof(SavedImage));
+        }
 
         return (sp);
     }
 }