From 140200be0b4d5355aab76a6fd474e17d117045ca Mon Sep 17 00:00:00 2001
From: lumi <lumi@suwi.moe>
Date: Sat, 7 Jun 2025 22:27:06 +0200
Subject: [PATCH] lzw: Fix reporting of bytes written in decoder

When the LZW decoder encounters an invalid code, it stops
processing the image and returns the whole buffer size.
It should return the amount of bytes written, instead.

Fixes #257

CVE: CVE-2025-6199

Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/c4986342b241cdc075259565f3fa7a7597d32a32]

Signed-off-by: Shaik Moin <moins@kpit.com>
---
 gdk-pixbuf/lzw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gdk-pixbuf/lzw.c b/gdk-pixbuf/lzw.c
index 15293560b..4f3dd8beb 100644
--- a/gdk-pixbuf/lzw.c
+++ b/gdk-pixbuf/lzw.c
@@ -208,7 +208,7 @@ lzw_decoder_feed (LZWDecoder *self,
                                 /* Invalid code received - just stop here */
                                 if (self->code >= self->code_table_size) {
                                         self->last_code = self->eoi_code;
-                                        return output_length;
+                                        return n_written;
                                 }
 
                                 /* Convert codeword into indexes */
-- 
2.34.1

