From 140200be0b4d5355aab76a6fd474e17d117045ca Mon Sep 17 00:00:00 2001 From: lumi Date: Sat, 7 Jun 2025 22:27:06 +0200 Subject: [PATCH] lzw: Fix reporting of bytes written in decoder When the LZW decoder encounters an invalid code, it stops processing the image and returns the whole buffer size. It should return the amount of bytes written, instead. Fixes #257 CVE: CVE-2025-6199 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/c4986342b241cdc075259565f3fa7a7597d32a32] Signed-off-by: Shaik Moin --- gdk-pixbuf/lzw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gdk-pixbuf/lzw.c b/gdk-pixbuf/lzw.c index 15293560b..4f3dd8beb 100644 --- a/gdk-pixbuf/lzw.c +++ b/gdk-pixbuf/lzw.c @@ -208,7 +208,7 @@ lzw_decoder_feed (LZWDecoder *self, /* Invalid code received - just stop here */ if (self->code >= self->code_table_size) { self->last_code = self->eoi_code; - return output_length; + return n_written; } /* Convert codeword into indexes */ -- 2.34.1