From 124b349500e790567c1a2fe8c7329b4d06c9e95a Mon Sep 17 00:00:00 2001
From: James Jackson-South <james_south@hotmail.com>
Date: Tue, 19 Dec 2017 11:01:34 +1100
Subject: [PATCH] Fix #403

---
 src/ImageSharp/Formats/Gif/GifDecoderCore.cs        |  3 ++-
 .../ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs | 13 ++++++++++++-
 tests/ImageSharp.Tests/TestImages.cs                |  1 +
 .../Gif/issues/issue403_baddescriptorwidth.gif      |  3 +++
 4 files changed, 18 insertions(+), 2 deletions(-)
 create mode 100644 tests/Images/Input/Gif/issues/issue403_baddescriptorwidth.gif

diff --git a/src/ImageSharp/Formats/Gif/GifDecoderCore.cs b/src/ImageSharp/Formats/Gif/GifDecoderCore.cs
index de22f190a5..ae20be7d5d 100644
--- a/src/ImageSharp/Formats/Gif/GifDecoderCore.cs
+++ b/src/ImageSharp/Formats/Gif/GifDecoderCore.cs
@@ -443,7 +443,8 @@ namespace SixLabors.ImageSharp.Formats.Gif
 
                 var rgba = new Rgba32(0, 0, 0, 255);
 
-                for (int x = descriptor.Left; x < descriptor.Left + descriptor.Width; x++)
+                // #403 The left + width value can be larger than the image width
+                for (int x = descriptor.Left; x < descriptor.Left + descriptor.Width && x < rowSpan.Length; x++)
                 {
                     int index = indices[i];
 
diff --git a/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs b/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs
index eb3e184c74..76a31c1864 100644
--- a/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs
+++ b/tests/ImageSharp.Tests/Formats/Gif/GifDecoderTests.cs
@@ -136,7 +136,7 @@ namespace SixLabors.ImageSharp.Tests
         }
 
         [Theory]
-        [WithFileCollection(nameof(BadAppExtFiles), PixelTypes)]
+        [WithFileCollection(nameof(BadAppExtFiles), PixelTypes.Rgba32)]
         public void DecodeBadApplicationExtensionLength<TPixel>(TestImageProvider<TPixel> imageProvider)
             where TPixel : struct, IPixel<TPixel>
         {
@@ -145,5 +145,16 @@ namespace SixLabors.ImageSharp.Tests
                 imageProvider.Utility.SaveTestOutputFile(image, "bmp");
             }
         }
+
+        [Theory]
+        [WithFile(TestImages.Gif.Issues.BadDescriptorWidth, PixelTypes.Rgba32)]
+        public void DecodeBadDescriptorDimensionsLength<TPixel>(TestImageProvider<TPixel> provider)
+            where TPixel : struct, IPixel<TPixel>
+        {
+            using (Image<TPixel> image = provider.GetImage())
+            {
+                provider.Utility.SaveTestOutputFile(image, "bmp");
+            }
+        }
     }
 }
\ No newline at end of file
diff --git a/tests/ImageSharp.Tests/TestImages.cs b/tests/ImageSharp.Tests/TestImages.cs
index 300e169ee8..365aea04ae 100644
--- a/tests/ImageSharp.Tests/TestImages.cs
+++ b/tests/ImageSharp.Tests/TestImages.cs
@@ -161,6 +161,7 @@ namespace SixLabors.ImageSharp.Tests
             {
                 public const string BadAppExtLength = "Gif/issues/issue405_badappextlength252.gif";
                 public const string BadAppExtLength_2 = "Gif/issues/issue405_badappextlength252-2.gif";
+                public const string BadDescriptorWidth = "Gif/issues/issue403_baddescriptorwidth.gif";
             }
 
             public static readonly string[] All = { Rings, Giphy, Cheers, Trans, Kumin };
diff --git a/tests/Images/Input/Gif/issues/issue403_baddescriptorwidth.gif b/tests/Images/Input/Gif/issues/issue403_baddescriptorwidth.gif
new file mode 100644
index 0000000000..0dce4b0eec
--- /dev/null
+++ b/tests/Images/Input/Gif/issues/issue403_baddescriptorwidth.gif
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c108091ffddd87178378656e37a7e975aa69be56376b9105adbbc14fe8d9a010
+size 707660