$OpenBSD: patch-IMG_gif_c,v 1.1 2008/03/31 21:19:17 jasper Exp $ --- IMG_gif.c.orig Fri Mar 28 18:36:08 2008 +++ IMG_gif.c Fri Mar 28 18:36:54 2008 @@ -406,6 +406,10 @@ LWZReadByte(SDL_RWops *src, int flag, int input_code_s static int stack[(1 << (MAX_LWZ_BITS)) * 2], *sp; register int i; + /* Fixed buffer overflow found by Michael Skladnikiewicz */ + if (input_code_size > MAX_LWZ_BITS) + return -1; + if (flag) { set_code_size = input_code_size; code_size = set_code_size + 1;