--- cups-1.3.6/filter/image-gif.c~ 2008-03-27 11:50:12.000000000 -0400 +++ cups-1.3.6/filter/image-gif.c 2008-03-27 11:50:12.000000000 -0400 @@ -38,6 +38,8 @@ #define GIF_INTERLACE 0x40 #define GIF_COLORMAP 0x80 +#define MAX_LWZ_BITS 12 + typedef cups_ib_t gif_cmap_t[256][4]; typedef short gif_table_t[4096]; @@ -461,6 +463,9 @@ gif_read_image(FILE *fp, /* I - ypos = 0; pass = 0; code_size = getc(fp); + + if (code_size > MAX_LWZ_BITS) + return (-1); if (!pixels) return (-1);