$OpenBSD: patch-libmpdemux_demux_gif_c,v 1.1 2016/07/05 06:59:29 jasper Exp $

CVE-2016-4352
https://trac.mplayerhq.hu/ticket/2295

--- libmpdemux/demux_gif.c.orig	Mon Mar  7 02:23:27 2016
+++ libmpdemux/demux_gif.c	Mon Jul  4 09:29:41 2016
@@ -304,6 +304,17 @@ static demuxer_t* demux_open_gif(demuxer_t* demuxer)
     return NULL;
   }
 
+  // Validate image size, most code in this demuxer assumes w*h <= INT_MAX
+  if ((int64_t)gif->SWidth * gif->SHeight > INT_MAX) {
+    mp_msg(MSGT_DEMUX, MSGL_ERR,
+           "[demux_gif] Unsupported picture size %dx%d.\n", gif->SWidth,
+           gif->SHeight);
+    if (DGifCloseFile(gif) == GIF_ERROR)
+      print_gif_error(NULL);
+    free(priv);
+    return NULL;
+  }
+
   // create a new video stream header
   sh_video = new_sh_video(demuxer, 0);
 
